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In  our  feature  article,  Seamus  Hughes  and  Alexander  Meleagrou-Hitchens 
focus  on  the  threat  to  the  United  States  from  the  Islamic  State’s  “virtual 
entrepreneurs”  who  have  been  using  social  media  and  encryption  applica¬ 
tions  to  recruit  and  correspond  with  sympathizers  in  the  West,  encouraging  and  directing  them  to 
engage  in  terrorist  activity.  They  find  that  since  2014,  contact  with  a  virtual  entrepreneur  has  been  a 
feature  of  eight  terrorist  plots  in  the  United  States,  involving  13  individuals. 

In  our  other  cover  article,  Ahmet  Yayla,  the  former  police  counterterrorism  chief  in  the  Turkish 
city  of  Sanliurfa  near  the  Syrian  border,  outlines  how  investigations  into  the  New  Year’s  Eve  Reina 
nightclub  attack  in  Istanbul  have  made  clear  the  “immense  scale  of  the  Islamic  State  threat  to  Turkey.” 
While  the  attack,  remotely  steered  by  Islamic  State  operatives  in  Raqqa,  was  the  work  of  a  single  gun¬ 
man,  a  50-strong  network  in  Istanbul  with  access  to  at  least  half  a  million  dollars  provided  logistical 
support.  With  the  Islamic  State  declaring  all-out  war  on  Turkey,  Turkish  counterterrorism  capacity 
severely  weakened  by  recent  purges,  as  many  as  2,000  Islamic  State  fighters  already  on  Turkish  soil, 
and  the  possibility  that  Islamic  State  fighters  will  flood  into  Turkey  as  the  caliphate  crumbles,  Yayla 
warns  of  severe  implications  for  international  security. 

Daniel  Heinke,  the  director  of  the  state  bureau  of  investigation  (LKA)  in  Bremen,  outlines  the  key 
findings  of  an  official  German  study  of  almost  800  German  foreign  fighters— the  largest  such  study 
by  a  Western  government — and  the  takeaways  for  smarter  counterterrorism.  He  notes  that  while  the 
number  of  Germans  traveling  to  join  the  Islamic  State  has  slowed  to  a  trickle,  there  has  been  a  surge 
in  violent  Islamist  extremism  inside  the  country,  creating  concern  that  returning  foreign  fighters  will 
add  “lethal  capabilities  to  an  already  highly  adrenalized  Islamist  community.”  Andrew  Zammit  out¬ 
lines  how  the  jihadi  threat  in  Australia  has  transformed  since  the  Islamic  State  called  for  attacks  in 
Western  countries.  While  there  has  been  an  increase  in  attacks  and  plots  in  Australia,  they  have  also 
become  less  sophisticated  and  ambitious.  Finally,  Matthew  DuPee  examines  the  growing  financial 
windfall  the  Afghan  Taliban  and  other  jihadi  groups  are  extracting  from  illegal  mining  in  Afghani¬ 
stan,  which  is  now  providing  the  Taliban  with  as  much  as  $300  million  in  revenue  per  year. 

Paul  Cruickshank,  Editor  in  Chief 
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The  Threat  to  the  United  States  from  the 
Islamic  State’s  Virtual  Entrepreneurs 

By  Seamus  Hughes  and  Alexander  Meleagrou-Hitchens 


Among  the  most  recent  evolutions  of  jihadi  terrorist  tactics 
in  the  West  has  been  the  rise  of  the  virtual  entrepreneur. 
The  increased  use  of  social  media,  often  paired  with 
applications  that  offer  the  option  of  encrypted  messaging, 
has  enabled  members  of  groups  like  the  Islamic  State 
to  make  direct  and  lasting  contact  with  radicalized 
Americans.  In  some  cases,  these  individuals  direct  terror 
plots,  and  in  others,  they  provide  encouragement  and 
motivation  for  attacks.  In  the  United  States,  there  are 
14  known  cases  of  terrorist-related  activity  involving 
19  U.S. -based  individuals  where  the  involvement 
of  an  Islamic  State  virtual  entrepreneur  has  been 
documented.  This  outsourcing  of  terrorism  has  been  a 
game  changer  in  Islamic  State  efforts  to  attack  the  West. 


Over  the  last  year,  a  new  term  has  entered  the  lexicon 
of  American  and  European  terrorism  analysts,  law 
enforcement,  and  national  security  journalists:  the 
‘virtual  plotter.’1  This  phrase,  and  variations  of  it,  de¬ 
scribes  members  of  jihadi  terrorist  groups,  mainly 
affiliated  with  the  Islamic  State,  who  use  social  media  and  applica¬ 
tions  with  encryption  capabilities  to  reach  out  to  and  correspond 
with  radicalized  Westerners.  The  emergence  of  applications  such 
as  Telegram,  SureSpot,  Kik,  and— since  its  recent  offering  of  end- 
to-end  encryption— WhatsApp  has  been  a  particular  game  changer 
for  the  Islamic  State  and  its  efforts  in  the  West.  In  some  cases,  its 
members  plot  and  direct  attacks,  helping  to  hone  and  focus  the 
often  undisciplined  zeal  of  potential  lone-actor  terrorists  so  as  to 
ensure  that  their  eventual  actions  achieve  either  the  maximum  pro¬ 
paganda  value  or  casualty  impact.3 

More  frequently,  however,  these  virtual  plotters  have  acted  in 
a  more  auxiliary  capacity,  plugging  their  Western  contacts  into 


a  The  plots  are  often  referred  to  as  ‘Islamic  State-enabled.'  While  this 

typology  is  useful,  it  is  also  problematic  as  it  may  suggest  that  the  plots  are 
planned  by  the  Islamic  State  leadership.  It  remains  unclear  if  Islamic  State 
virtual  entrepreneurs  are  taking  direction  from  senior  Islamic  State  figures 
or  acting  independently. 


Seamus  Hughes  is  Deputy  Director  of  the  Program  on  Extremism 
at  George  Washington  University.  Follow  @SeamusHughes 

Alexander  Meleagrou-Hitchens,  Ph.D.,  is  Research  Director  of  the 
Program  on  Extremism  at  George  Washington  University.  Follow 
@amhitchens 


wider  extremist  milieus  (both  online  and  offline)  and  encouraging 
extreme  beliefs,  while  offering  suggestions  and  options  for  mobili¬ 
zation.  Indeed,  because  of  the  variety  of  roles  they  play,  the  authors 
have  chosen  to  refer  to  these  individuals  as  ‘virtual  entrepreneurs,’ 
thus  allowing  for  a  broader  encapsulation  of  the  different  catego¬ 
ries  of  their  involvement.  Out  of  a  total  of  38  Islamic  State-inspired 
domestic  plots  and  attacks  in  the  United  States  between  March  1, 
2014,  and  March  1,  2017,  at  least  eight  (21  percent)  have  involved 
some  form  of  digital  communication  with  virtual  entrepreneurs.11 
The  peak  period  for  this  activity  was  2015,  with  virtual  entrepre¬ 
neurs  involved  in  six  separate  plots.  In  addition,  virtual  entrepre¬ 
neurs  have  also  been  involved  in  at  least  six  other  terrorism-related 
cases,  including  assisting  with  logistics  related  to  traveling  to  join 
the  Islamic  State.3  This  brings  the  total  number  of  U.S.  terrorism 
cases  linked  to  Islamic  State  virtual  entrepreneurs  to  14,  involving 
19  U.S.-based  individuals. 

This  development  is  a  reminder  that  the  strategies  and  tactics 
pursued  by  the  modern  global  jihad  movement,  as  part  of  its  ef¬ 
forts  to  maintain  an  international  presence  and  ability  to  conduct 
attacks,  are  varied  and  evolving.  Jihadi  strategists  swiftly  adapt  to 
the  constantly  shifting  environments  around  them  while  opportu¬ 
nistically  exploiting  new  technologies.  One  of  the  benefits  of  such 
increased  contact  with  radicalized  Westerners  is  that  it  has  given 
the  Islamic  State  wider  scope  to  claim  ownership  of  attacks  that  it 
had  little  to  do  with  in  reality.  This  allows  it  to  inflate  its  impact  and 
reach,  which  is  crucial  to  the  group’s  propaganda  efforts. 

To  some  extent,  the  emergence  of  virtual  entrepreneurs  rep¬ 
resents  a  hybrid  between  what  are  commonly  seen  as  the  two 
previous  manifestations  of  the  jihadi  terrorist  threat  to  the  West: 
networked  and  inspired  lone-attacker  plots.  The  former  relies  on 
direct  involvement  by  an  organization  in  terms  of  training,  direc¬ 
tion,  financing,  and  indoctrination.  The  lone-actor  and  now  hybrid 
categories  rely  more  on  the  creation  of  loosely  connected  milieus, 
often  online,  and  the  wide  availability  of  an  accessible  form  of  global 


b  The  eight  separate  plots  involved  13  individuals  in  total.  They  are  Fareed 
Mumuni  and  Munther  Omar  Saleh  (2015);  David  Daoud  Wright  and 
Nicholas  Rovinski  (2015);  Munir  Abdulkader  (2015);  Justin  Nojan  Sullivan 
(2015);  Jalil  Ibn  Ameer  Aziz  (2015);  Emanuel  Lutchman  (2015);  Abdul 
Malik  Abdul  Kareem  (2015);  and  Mohamed  Bailor  Jalloh  (2016).  The  dates 
provided  here  reflect  when  the  defendants  were  charged,  as  opposed  to 
when  the  offense  was  carried  out  or  contact  was  made  with  the  virtual 
entrepreneur.  Three  individuals  were  killed  either  conducting  their 
operation  or  during  attempts  to  arrest  them.  Garland  attackers  Nadir  Soofi 
and  Elton  Simpson  were  killed  while  conducting  their  operation.  Usaamah 
Abdullah  Rahim  was  killed  when  officers  tried  to  arrest  him.  Soofi  and 
Simpson  committed  the  attack  with  assistance  from  Adbul  Malik  Abdul 
Kareem.  Source:  court  documents. 

c  They  are  Avin  Brown  (2014),  Mohammed  Hamzah  Khan  (2014),  Nader 
Elhuzayel  (2015),  Ardit  Ferizi  (2015),  Aaron  T.  Daniels  (2016),  and  Abdul 
Raheem  FHabil  Ali-Skelton  (2016). 
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jihadi  propaganda.  Together,  these  help  inspire  individuals  to  carry 
out  attacks  on  their  own  and  in  the  name  of  the  global  jihad  move¬ 
ment,  or  a  specific  group  within  it. 

Law  enforcement  has  understandably  struggled  to  categorize 
this  new  development.  Speaking  at  the  Washington  Institute  for 
Near  East  Policy,  FBI  Executive  Assistant  Director  for  the  National 
Security  Division  Michael  Steinbach  offered  some  measure  of  clar¬ 
ity.  He  described  the  current  threat  picture  as  “a  hybrid  between 
directed  and  enabled  ...  individuals  overseas  using  encrypted  com¬ 
munications  to  elicit  some  type  of  assistance  from  somebody  in  the 
U.S.”  He  also  pointed  out  that  these  figures  often  do  not  specifically 
direct  attacks  but  rather  help  in  “getting  somebody  ready  to  go  ... 
getting  them  motivated,  showing  them  a  menu  of  targets  and  then 
saying,  ‘hey,  you  take  care  of  it.’”2 

However,  while  the  use  of  this  tactic  has  increased  as  the  Islamic 
State  continues  to  exploit  social  media  and  online  encryption  tech¬ 
nologies,  the  phenomenon  of  jihadi  entrepreneurs  making  virtual 
connections  with  unaffiliated  radicalized  Westerners  is  certainly 
not  new.  As  is  often  the  case  when  discussing  innovative  jihadis, 
one  need  only  look  at  the  activities  of  the  late  Yemeni- American 
jihadi  ideologue  and  recruiter  Anwar  al-Awlaki,  who,  via  email, 
was  in  contact  with  a  number  of  radicalized  individuals  in  the  West 
and  who,  in  at  least  one  case,  helped  plot  a  potential  attack.4  Social 
media  and  encrypted  messaging  apps,  along  with  an  expansion  of 
jihadi  territories  across  the  globe,  are  all  factors  that  have  nonethe¬ 
less  added  a  new  dimension  to  such  virtual  communications. 

One  of  the  most  devastating  recent  examples  of  this  tactic  come 
from  Europe.  In  France,  Islamic  State  member  Rachid  Kassim  has 
been  linked  to  at  least  two  plots  that  were  initially  believed  to  have 
been  carried  out  by  inspired  lone-actors  with  no  oversight  or  di¬ 
rection  from  the  Islamic  State.3  He  is  also  thought  to  have  been 
the  orchestrator  of  over  half  of  the  17  total  plots  foiled  by  French 
authorities  in  2016.4  Much  of  the  planning  was  done  through  his 
Telegram  channel  ‘Sabre  de  Lumiere’  (Sword  of  Light).5 

In  the  United  States,  the  impact  of  virtual  entrepreneurs  has 
not  been  as  deadly  as  in  Europe,  but  this  is  not  for  want  of  trying. 
The  most  sustained  efforts  to  import  this  type  of  terrorism  to  the 
United  States  have  come  from  a  group  based  in  Islamic  State-held 
Raqqa,  Syria,  which  the  FBI  has  nicknamed  ‘the  Legion.’  Made  up 
of  around  a  dozen  English-speaking  and  mainly  Western  Islamic 
State  operatives,  the  group  has  systematically  reached  out  to  indi¬ 
viduals  in  the  United  States  using  a  mixture  of  direct  messaging  on 
Twitter  and  encrypted  messaging.6  e  The  Legion  has  presented  such 


d  This  was  the  case  of  British  Airways  employee  Rajib  Karim.  For  more,  see 
Alexander  Meleagrou-Flitchens,  “As  American  as  Apple  Pie:  Flow  Anwar 
al-Awlaki  Became  the  Face  of  Western  Jihad,”  International  Centre  for  the 
Study  of  Radicalisation  and  Political  Violence,  September  11,  2011,  and  Scott 
Shane,  Objective  Troy  (New  York:  Tim  Duggan  Books,  2016). 

e  The  membership  of  the  Legion  has  yet  to  be  fully  identified.  At  the  very 
least,  it  publicly  consisted  of  British  citizens  Junaid  Flussain  (also  known 
as  Abu  Flussain  al-Britani)  and  his  wife,  Sally  Jones  (also  known  as  Umm 
Flussain  al-Britani);  Reyaad  Khan  (also  known  as  Abu  Dujana);  Raphael 
Flostey  (also  known  as  Abu  Qaqa);  and  Trinidadian  citizen  Shawn  Parson 
(also  known  as  Abu  Khalid  al-Amriki).  Based  on  conversations  with 
individuals  familiar  with  the  group,  the  authors  also  strongly  suspect 
that  another  British  national,  Omar  Hussain  (also  known  as  Abu  Sa’eed 
al-Britani),  is  also  a  member.  Abu  Sa’ad  al-Sudani  was  not  a  member  of  the 
Legion  but  had  close  coordination  with  the  group.  For  example,  in  at  least 
one  instance,  Omar  Hussain  edited  the  online  postings  of  al-Sudani. 


a  threat  that,  between  2015  and  2016,  three  of  its  members  were 
killed  in  targeted  strikes:  Junaid  Hussain,  Reyaad  Khan,  and  Ra¬ 
phael  Hostey.  While  not  a  member  of  the  Legion,  Abu  Sa’ad  al-Su¬ 
dani,  another  Islamic  State  virtual  entrepreneur  who  was  identified 
by  the  Department  of  Defense  as  a  “member,  recruiter  and  external 
planner,”  was  also  killed  in  April  2016.7 

Hussain,  the  most  prominent  member  of  the  Legion,  was  a 
British  foreign  fighter  and  former  hacker.8  In  2013,  while  on  bail 
for  hacking  charges,  Hussain  traveled  to  Islamic  State-controlled 
territory,  assuming  the  kunya  Abu  Hussain  al-Britani.’9  Before  his 
death  in  August  2015,  which  is  thought  to  have  been  the  result  of  a 
British  operation  codenamed  ‘Illuminative’  carried  out  by  a  U.S.  air- 
strike,  Hussain  had  achieved  celebrity  status  among  the  online  En¬ 
glish-speaking  Islamic  State  community.  Both  he  and  fellow  British 
national  Khan  were  identified  by  the  then-British  Prime  Minister 
David  Cameron  as  being  “involved  in  actively  recruiting  ISIL  sym¬ 
pathizers  and  seeking  to  orchestrate  specific  and  barbaric  attacks 
against  the  West.”10  The  other  known  British  member  of  the  Legion, 
Hostey  (also  known  as  Abu  Qaqa),  had  traveled  to  Syria  in  2013 
and  was  mainly  engaged  in  recruiting  foreign  fighters  and  creating 
English-language  propaganda.11  Little  is  known  about  al-Sudani, 
who  was  better  known  online  as  Abu  Isa  al-Amriki,  though  he  has 
been  connected  to  a  number  of  failed  attacks  and,  under  the  name 
‘HoneyNTea,’  used  Telegram  to  run  an  Islamic  State  terrorist  cell  in 
India.12  In  an  online  posting  entitled  Days  of  Sahawatt,  al-Sudani 
describes  himself  as  “merely  a  solider  [sic]  from  among  many  other 
better  soldiers  here  in  the  Islamic  State.”13 

Virtual  entrepreneurs  are  not  only  found  in  Syria.  Another 
prominent  figure  is  Mohamed  Abdullahi  Hassan,  who  has  used  var¬ 
ious  online  aliases,  including  Mujahid  Miski.  A  Somali-American 
from  Minnesota,  he  traveled  to  Somalia  in  2009  to  join  the  al-Qa'  i- 
da-linked  militia  al-Shabaab  and  was  indicted  that  year  on  charges 
of  material  support  to  terrorism.  He  has  since  claimed  that  he  left 
al-Shabaab  in  2013  due  to  its  brutal  treatment  of  Somali  civilians. 
Miski  has  also  stated  in  an  interview  that  in  late  2015,  his  home 
was  raided  by  al-Shabaab,  forcing  him  to  flee  and  turn  himself  in 
to  Somali  authorities.14  It  is  likely  that  he  was  also  targeted  because 
of  his  support  for  the  Islamic  State/ 

Before  Miski  turned  himself  in,  he  too  was  active  online  and 
maintained  contact  with  a  number  of  Americans.  Over  the  years, 
he  acted  as  a  key  conduit  between  al-Shabaab  and  radicalized 
members  of  the  Somali-American  community  in  the  Twin  Cities. 
Following  the  rise  of  the  Islamic  State,  he  had  also  formed  online 
relationships  with  American  supporters  of  the  group,  helping  them 
in  a  variety  of  ways.15 

This  paper  analyzes  the  impact  of  virtual  entrepreneurs  in  the 
United  States  and  is  among  the  first  to  use  primary  sources  to  do  so. 
It  is  based  on  a  review  of  court  filings  and  interviews  with  law  en¬ 
forcement  officials,  reporters,  and  attorneys  connected  to  the  cases. 
To  present  a  broader  and  more  accurate  picture  of  the  threat,  the 
authors  have  categorized  exchanges  between  American-based  Is¬ 
lamic  State  sympathizers  and  virtual  entrepreneurs  as  either  ‘direct 


f  Since  early  2015,  the  Islamic  State  has  attempted  to  coax,  and  later  coerce, 
al-Shabaab  to  switch  its  allegiances  from  al-Qa '  ida.  The  leadership  has 
fiercely  and  violently  resisted  these  efforts,  imprisoning  and  killing  any 
suspected  Islamic  State  sympathizers. 
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plotting’  or  ‘encouragement  and  facilitation.’® 

Direct  Plotting 

Ultimately,  virtual  entrepreneurs  have  found  themselves  targeted 
by  authorities  not  only  because  of  their  online  conversations  with 
radicalized  Americans,  but  also  their  direct  involvement  in  terrorist 
plots  in  the  West.  Among  the  most  clear-cut  examples  of  a  virtu¬ 
al  entrepreneur  planning  an  attack  is  that  of  Ohio  resident  Munir 
Abdulkader,  who  pleaded  guilty  to  a  plot  to  attack  U.S.  government 
officers.16  His  flirtation  with  the  Islamic  State  began  in  July  2014 
when  he  established  Twitter  accounts  to  voice  his  support  for  the 
group.17  Once  he  had  plugged  himself  into  the  online  Islamic  State 
community,  it  was  not  long  until  he  came  across  and  reached  out 
to  Hussain  who,  in  effect,  became  his  handler  in  the  spring  of  2015. 
According  to  court  documents,  Abdulkader  “was  in  electronic  com¬ 
munication  with  at  least  one  member  of  ISIL  overseas  named  Ju- 
naid  Hussain,  and  placed  himself  under  the  direction  of  ISIL  and 
its  overseas  leadership.”18  Initially,  Abdulkader  was  interested  in 
traveling  to  Syria,  but  according  to  Assistant  U.S.  Attorney  Timothy 
Mangan,  who  prosecuted  the  case,  “Hussain  helped  push  him  to  a 
different  course”  and  turn  his  focus  to  a  domestic  attack  “when  they 
decided  it  simply  had  gotten  too  dangerous  to  go  to  an  airport.”19 

Over  the  course  of  their  communications,  Hussain  “ultimately 
laid  out ...  an  overall  terrorist  attack  plan  for  Abdulkader  ...  to  im¬ 
plement.”20  More  specifically,  he  instructed  Abdulkader  to  kidnap 
an  American  soldier  and  record  his  killing  on  camera,  providing 
him  with  the  target’s  name  and  address.  The  pair  also  discussed  the 
best  weapon  to  use  and  the  need  to  record  the  attack  for  later  pro¬ 
paganda  dissemination.21  Following  this,  Hussain  suggested  that 
Abdulkader  attack  a  police  station  in  Cincinnati,  Ohio.  Abdulkad¬ 
er  also  drew  encouragement  from  Hussain  that  helped  increase 
his  mettle  to  carry  out  a  violent  act.  During  one  of  their  encrypted 
online  discussions  in  May  2015,  he  recounted  to  Hussain  his  first 
experience  at  a  shooting  range,  telling  him  it  was  a  “whole  new  ex¬ 
perience  but  did  well.  We  used  magnums,  other  pistols,  ml5  or  m5 
...  I  love  it!  Got  the  targets  in  face  or  [stomach],”  to  which  Hussain 
responded,  “Next  time  ul  [sic]  be  shooting  kuffar  [nonbelievers]  in 
their  face  and  stomach.”22 

Among  Hussain’s  main  interests  was  inciting  and  directly 
planning  attacks  against  people  and  groups  seen  as  maligning  the 
Prophet  Mohammad.  In  mid-May  2015,  David  Daoud  Wright, 
Nicholas  Alexander  Rovinski,  and  Usaamah  Abdullah  Rahim  were 
in  the  advanced  stages  of  a  plan  to  kill  an  organizer  of  the  Muham¬ 
mad  Art  Exhibit  and  Contest,  an  event  in  Garland,  Texas.  Rahim, 
the  senior  member  of  the  group,  liaised  with  Hussain  about  possible 
attacks.  The  target  was  decided  upon  as  a  result  of  these  conversa¬ 
tions,  during  which  “Hussain  directly  communicated  instructions 
to  Rahim  with  regard  to  the  murder  of  [the]  Intended  Victim,” 
which  Rahim  subsequently  passed  on  to  his  accomplice,  Wright.23 

Due  to  the  contact  between  Rahim  and  Hussain  and  subsequent 
activities  by  the  plotters— including  Rahim’s  purchase  of  combat 
knives  at  the  recommendation  of  Hussain  “in  case  the  ‘feds’  tried  to 
arrest  him”24— they  soon  became  the  subjects  of  law  enforcement 
surveillance.  On  June  2, 2015,  Rahim  was  approached  by  investiga¬ 


g  While  such  an  approach  is  useful  and  necessary  in  order  to  better 

understand  the  threat,  the  levels  of  involvement  of  virtual  entrepreneurs 
remain  fluid  and  defy  precise  categorization. 


tors  while  walking  through  a  parking  lot  in  Roslindale,  Massachu¬ 
setts,  and  shot  dead  after  attempting  to  attack  them  with  a  knife. 
Rovinski  pleaded  guilty,  and  Wright  is  currently  awaiting  trial  on 
terrorist  charges. 

Junaid  Hussain  and  Reyaad  Khan  had  begun  their  attempts  to 
direct  plots  in  the  United  States  as  early  as  2014,  when  they  used  so¬ 
cial  media  to  solicit  Minnesota  resident  Abdul  Raheem  Ali-Skelton 
to  “carry  out  an  attack  in  the  United  States.”25  During  the  previous 
months,  he  had  been  interacting  and  debating  with  Islamic  State 
members  on  social  media  and  was  soon  referred  to  the  two  Legion 
members.  Ali-Skelton  refused  their  request,  however,  and  was  later 
arrested  and  convicted  for  lying  about  his  contact  with  the  Legion. 

Encouragement  and  Facilitation 

While  it  is  in  their  roles  as  direct  plotters  that  virtual  entrepreneurs 
gain  the  most  attention,  much  of  their  work  has  involved  encour¬ 
aging  their  contacts  to  take  on  more  extreme  positions  and  helping 
them  make  connections  in  real-world  foreign  fighter  networks. 

“Very  soon  carrying  out  1st  operation  of  Islamic  State  in  North 
America,”  ‘TheMujahid’  texted  to  his  online  contact.  The  response 
was  quick:  “Can  u  make  a  video  first?” 

“TheMujahid,”  it  has  since  been  revealed,  was  North  Carolina 
native  Justin  Sullivan,  and  his  Islamic  State  contact  was  Hussain, 
who  was  writing  under  one  of  several  online  monikers  he  was  us¬ 
ing.26  According  to  documents  from  his  case,  messages  found  on 
Sullivan’s  cell  phone  showed  that  he  “conspired  and  agreed  with 
Junaid  Hussain  to  commit  such  attacks  on  behalf  of,  and  in  support 
of,  ISIL  and  in  an  effort  to  change  United  States  policies  against 
ISIL  by  avenging  U.S.-coalition  airstrikes  against  ISIL  fighters.”27 
Sullivan  had  converted  to  Islam  in  September  2014  and  soon  began 
reading  Islamic  State  propaganda.  In  December  2014,  he  used  his 
father’s  gun  to  murder  his  elderly  neighbor,  though  the  motive  for 
this  has  never  been  fully  established.28 

By  mid-2015,  Sullivan  had  planned  to  buy  an  assault  rifle  at  a 
local  gun  show  and  expressed  a  desire  to  kill  up  to  1,000  people.29 
Perturbed  by  his  son’s  behavior,  which  included  destroying  Bud¬ 
dha  statues  and  other  non-Islamic  religious  items,  Sullivan’s  father 
called  911  and  informed  authorities  of  his  suspicion  that  his  son 
was  becoming  an  Islamic  State  supporter.30  After  subsequently  en¬ 
tering  into  conversations  with  an  FBI  undercover  agent  in  which 
he  discussed  his  intentions  to  carry  out  an  attack,  he  was  arrested 
in  June  2015  and  pleaded  guilty  to  providing  material  support  to 
terrorism.  Sullivan’s  case  is  indicative  of  the  wider  impact  of  virtual 
entrepreneurs  in  the  United  States  beyond  direct  attack  planning.31 
He  was  not  only  provided  with  the  encouragement,  reassurance, 
and  comradery  he  needed,  but  he  also  received  specific  advice  on 
how  to  ensure  his  attack  could  provide  the  most  benefit  to  the  Is¬ 
lamic  State. 

Another  U.S.  case  that  sheds  further  light  on  the  multifacet¬ 
ed  role  of  virtual  entrepreneurs  is  that  of  Jalil  ibn  Ameer  Aziz  of 
Pennsylvania.  Prior  to  his  arrest  in  December  2015  on  charges  of 
conspiracy  to  provide  material  support  to  the  Islamic  State,  Aziz 
was  heavily  involved  in  online  extremist  networks,  creating  at  least 
57  pro-Islamic  State  Twitter  accounts.32  When  authorities  searched 
his  house,  they  discovered  a  tactical-style  backpack  with  multiple 
machine  guns  and  other  weapons.33 

Aziz  helped  connect  would-be  American  Islamic  State  foreign 
fighters  with  Hussain  and  Khan.  According  to  court  filings,  Hus¬ 
sain  provided  Aziz  with  a  Turkish  telephone  number,  which  he  was 


MARCH  2017 


HUGHES  /  MELEAGROU-HITCHENS 


4 


CTC  SENTINEL 


vs  eMT^ep^eMevpvs 

i — , 


r~  KILLED  IN 
HOAl  ELAND 
ATTACK 


Ab*W  A^l;k 

AbdJ 


FVre««* 

yVUrvW''' 


/Vloh^incJ 
AbJv^l/^h;  Ha ss»»n 


lah"ieen  '  ^yAliat, 


HjSSaiM 


Ab*U/  2-^heem 
A/.-5kel+o»i 


AUrt+hei- 

5«delo 


E/+OH 


5Jb«>i 


M  u'*5”'  \ 


-|-eX+5 


KILLED 
w  SYRIA, 


A/«Jez-  'Z. 
Elh^iivyel 


AbJ  jlks.Jer- 


Ab^  lss«* 

A/— Arw-ik 


Lls<»e.in<!>h 

(2.«xhiVn 


J alii  Ibrt 
Aineez-  Az  iz 


A^j.+  Fer-lzi 


Eznart  s/el 
UoPc  hzVl^M 


^  A/.choUs 
E-ov/iMsk; 


A/el  P^- 


Aloh«-"V\"Vie  J  KUmr*  refers  /o  Hos+e 


A\ZtH 


HerrVIZ  erfe  Kh«vH 


Graphic  produced,  hy  the  Program  on  Extremism  at  George  Washington  University 


then  to  share  with  a  potential  recruit  so  that  he  could  communicate 
with  them  using  encrypted  messaging  applications.  Hussain  also 
suggested  to  Aziz  that  if  there  were  any  problems,  the  recruit  should 
contact  another  member  of  the  Legion,  Hostey,  via  a  Twitter  profile 
he  provided.34 

Hostey  also  communicated  with  at  least  two  other  Islamic  State 
supporters.  One  of  them,  Avin  Brown,  was  the  first  American  to  be 
arrested  for  trying  to  travel  and  join  the  Islamic  State.  U.S.  prose¬ 
cutors  charged  him  with  providing  material  support  to  terrorism 
in  March  2014  after  he  attempted  to  board  a  flight  in  North  Caroli¬ 
na  bound  for  Turkey.35  Brown  was  friendly  online  with  Hostey  and 
helped  connect  him  with  another  American  Islamic  State  recruit, 
Mohammed  Khan,  from  Chicago.  In  October  2014,  Mohammed 
Khan  and  his  two  younger  siblings  were  arrested  at  O’Hare  Inter¬ 


national  Airport  as  they  attempted  to  fly  to  Turkey  in  order  to  join 
the  Islamic  State,  with  Hostey  allegedly  providing  the  logistical 
support.36 

Between  late  2015  and  mid-2016,  another  domestic  Islamist  ter¬ 
rorist,  Mohamed  Bailor  Jalloh,  had  been  in  communication  with 
Islamic  State  virtual  entrepreneur  al-Sudani.  Jalloh  had  traveled 
to  Nigeria,  via  his  native  country  of  Sierra  Leone,  in  June  2015 
where  he  met  an  unnamed  Islamic  State  facilitator  with  the  intent 
of  receiving  assistance  to  join  the  group  in  Libya.  He  eventually 
decided  against  this  and  opted  instead  for  a  plan  to  attack  the  U.S. 
homeland.  It  was  on  his  way  back  to  the  United  States,  while  he  was 
in  Sierra  Leone,  that  Jalloh  first  made  online  contact  with  al-Su- 
dani.  According  to  court  documents,  he  was  someone  whom  Jalloh 
“understood  was  an  ISIL  figure  engaged  in  plotting  attacks  in  the 
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United  States.”37 

After  his  return  to  the  United  States,  Jalloh  communicated  reg¬ 
ularly  with  al-Sudani  during  the  first  half  of  2016.  On  two  separate 
occasions,  al-Sudani  arranged  for  a  total  of  $700  to  be  sent  to  him 
via  a  family  member  of  Jalloh’s  in  Sierra  Leone,  who  gave  the  funds 
to  a  contact  of  al-Sudani’s  in  the  country.  By  March  2016,  court 
records  show  that  al-Sudani  “was  actively  plotting  an  attack  in  the 
United  States.”  As  part  of  these  efforts,  he  had  put  Jalloh  in  touch 
with  another  U.S.-based  contact  of  his  in  the  hope  that  they  would 
plan  an  attack  together.38  Unbeknownst  to  al-Sudani,  his  contact 
was  an  FBI  informant.  Jalloh  first  met  the  informant  in  April  2016 
in  Virginia  and  began  discussing  with  him  various  options  for  an 
attack  in  the  name  of  the  Islamic  State.  During  the  meeting,  Jal¬ 
loh  claimed  that  he  was  constantly  thinking  about  conducting  an 
attack,  and  when  asked  to  elaborate,  he  said  “Nidal  Hassan  type  of 
things.  That’s  the  kind  of  stuff  I  started  thinking.”39  As  a  result  of 
the  investigation,  Jalloh  was  arrested  in  July  2016  after  attempting 
to  buy  a  weapon  in  North  Carolina  that  he  intended  to  use  for  an 
attack.  He  was  later  sentenced  to  11  years  in  prison  for  conspiracy 
to  provide  material  support  to  the  Islamic  State.40 

Al-Sudani  was  also  heavily  involved  in  encouraging  New  York- 
based  Islamic  State  supporter  Emanuel  Lutchman  to  plan  an  attack 
in  the  city.  They  began  communicating  online  in  December  2015 
after  Lutchman  found  al-Sudani’s  contact  in  an  Islamic  State-pro¬ 
duced  online  document.41  During  these  discussions,  Lutchman  ex¬ 
pressed  his  desire  to  travel  to  Libya  in  order  join  the  Islamic  State, 
but  he  was  told  by  al-Sudani  that  he  first  had  to  prove  himself  to  the 
group  by  executing  an  attack  in  the  United  States.  Al-Sudani  also 
pointed  out  that  due  to  his  location  “behind  enemy  lines,”  Lutch- 
man’s  real  utility  to  the  Islamic  State  was  as  a  domestic  terrorist.42 
He  told  Lutchman  to  plan  an  attack  for  New  Year’s  Eve  2015,  when 
he  would  have  easy  access  to  large  crowds.  He  also  offered  Lutch¬ 
man  various  pieces  of  advice  both  to  ensure  that  the  operation  was 
as  effective  as  possible  and  to  avoid  capture  beforehand.  Once  the 
operation  was  complete,  al-Sudani  promised  Lutchman  he  would 
vouch  for  him  to  the  Islamic  State  after  he  arrived  in  Libya. 

By  late  December,  Lutchman— while  maintaining  regular  con¬ 
tact  with  al-Sudani,  who  continued  to  offer  advice  and  moral  sup¬ 
port-had  begun  plotting  an  attack  with  three  accomplices.  He 
was  unaware,  however,  that  all  of  these  individuals  were  working 
for  the  FBI.  On  December  28,  Lutchman  identified  a  restaurant  in 
Rochester,  New  York,  as  a  target  and  began  planning  an  attack  that 
entailed  taking  hostages  and  executing  them  with  a  machete.43  Two 
days  later,  he  recorded  the  video  al-Sudani  had  requested  of  him. 
Holding  his  index  finger  aloft,  he  pledged  allegiance  to  the  Islamic 
State  and  announced  that  “the  blood  that  you  spill  of  the  Muslim 
overseas,  we  gonna  spill  the  blood  of  the  kuffar  [unbelievers].”44  He 
was  arrested  immediately  afterward,  and  in  August  2016,  Lutch¬ 
man  pleaded  guilty  to  conspiracy  to  provide  material  support  to 
the  Islamic  State. 

The  virtual  entrepreneurs  of  the  Islamic  State  appear  to  be  issu¬ 
ing  similar  sets  of  instructions  to  their  American  contacts,  almost 
as  if  they  are  working  from  a  common  script.  For  example,  al-Su- 
dani  asked  two  things  of  Lutchman  that  match  what  Hussain  had 
advised  Usaamah  Abdullah  Rahim  and  Justin  Sullivan.  Lutchman 
was  told  to  carry  a  weapon  with  him  at  all  times  in  case  the  author¬ 
ities  attempted  to  arrest  him,  so  that  if  “something  happens,  kill 
them  all.”45  Al-Sudani  also  asked  Lutchman  to  send  him  a  written 
message  and  videos  announcing  his  bay  'a  (allegiance)  to  the  Is¬ 


lamic  State,  which  could  be  released  after  the  attack  and  allow  the 
group  to  claim  responsibility  and  “let  the  worlds  know  [ISIL  is] 
coming.”46  While  it  is  unclear  if  Islamic  State  virtual  entrepreneurs 
are  sharing  information  and  tradecraft  amongst  themselves,  this 
certainly  would  appear  to  be  the  case. 

Figures  like  al-Sudani  and  Hussain  gained  such  respect  among 
English-speaking  Islamic  State  supporters  around  the  world  that 
they  were  also  sought  out  online  in  order  to  give  their  blessing  for 
attacks,  much  in  the  same  way  that  extremist  sheikhs  provided  fat- 
was  in  the  past.  Around  the  same  time  that  Ohio  resident  Munir 
Abdulkader  was  coordinating  his  attack  with  Hussain,  a  young  man 
from  New  York  was  looking  for  approval  for  a  “martyrdom  attack.”47 
According  to  court  records  submitted  as  part  of  a  plea  agreement, 
the  man  in  question,  Munther  Omar  Saleh,  reached  out  to  Hussain 
for  advice  on  behalf  of  his  friend  Fareed  Mumuni,  stating  “akh  (a 
brother)  who  is  planning  on  hitting  a  black  car  cop  [police  car]  with 
a  pressure  cooker,  the  black  car  keeps  following  him,  and  he  wants 
to  avenge  our  akhs  (brothers)  who  have  been  raided  and  blocked 
from  hijrah.  Is  it  permissible  for  him  to  do  the  attack  and  die  pur¬ 
posely  in  the  process?”  Hussain  responded,  “Yes  akhi  (my  brother) 
he  can  do  an  isthishadi  (martyrdom)  operation  on  the  police  akhi  if 
he  has  no  other  way  to  fight  them  he  can  do  it.”  Not  one  to  miss  an 
opportunity  for  propaganda  production,  Hussain  also  told  Saleh  to 
have  Mumuni  send  any  martyrdom  video  directly  to  him.48  h  When 
the  FBI  arrived  at  Mumuni’s  house  to  execute  a  search  warrant,  he 
attacked  one  of  the  special  agents  with  a  knife,  stabbing  him  repeat¬ 
edly  but  failing  to  penetrate  his  body  armor.49  He  was  instructed  to 
do  so  by  Hussain,  and  this  is  consistent  with  the  type  of  instructions 
he  gave  to  Rahim  and  al-Sudani  to  Lutchman. 

While  Hussain  provided  instructions  in  a  plot  to  attack  the  or¬ 
ganizer  of  the  Muhammad  Art  Exhibit  and  Contest,  he  was  also,  at 
the  very  least,  on  the  periphery  of  a  major  conspiracy  to  attack  the 
event  itself.  On  May  3,  2015,  Elton  Simpson  and  his  accomplice, 
Nadir  Soofi,  traveled  to  Garland,  Texas,  as  part  of  a  plot  to  use  as¬ 
sault  rifles  to  kill  attendees.  In  the  months  preceding  the  attack, 
which  ended  in  the  deaths  of  both  men  before  they  could  enter  the 
venue,  Simpson  had  been  in  direct  contact  with  at  least  two  virtual 
entrepreneurs  using  Twitter  direct  message  and  SureSpot.  Indeed, 
while  he  was  willing  to  risk  using  the  internet  to  communicate  with 
fellow  extremists  abroad,  Simpson  was  wary  of  discussing  his  vio¬ 
lent  plans  via  Twitter,  once  lightheartedly  chiding  one  of  his  con¬ 
tacts  for  his  lax  protocols:  “I  expect  a  higher  level  of  security  from 
you  my  brother.”50 

Shortly  before  Simpson  attempted  the  attack,  he  logged  on  to 
Twitter  and  urged  users  to  follow  @_AbuHu55ain,  one  of  the  ac¬ 
counts  operated  by  Hussain.51  In  addition,  an  hour  before  the  at¬ 
tack,  Hussain  himself  tweeted  a  number  of  messages  suggesting  he 
was  aware  of  the  impending  shooting,  including:  “The  knives  have 
been  sharpened,  soon  we  will  come  to  your  streets  with  death  and 
slaughter!”52  Two  days  later,  the  Islamic  State  released  a  statement 
taking  credit  for  the  attack  in  what  was  its  first  of  several  claims  of 
operations  in  the  United  States.53  While  the  clues  certainly  exist, 


h  Although  the  court  records  do  not  explicitly  name  the  ‘ISIL  Facilitator,’  the 
U.S.  attorney  announced  it  was  Junaid  Flussain  in  remarks  to  the  press. 

i  Elton  Simpson's  online  discussions  with  Flussain  were  presented  as 

evidence  for  the  prosecution  in  United  States  v.  Abdul  Malik  Abdul  Kareem 
(2016). 


MARCH  2017 


HUGHES  /  MELEAGROU-HITCHENS 


6 


CTC  SENTINEL 


there  is  no  clear  evidence  that  Hussain  had  a  direct  hand  in  plotting 
this  attack,  though  there  is  no  doubt  he  encouraged  Simpsons  ex¬ 
tremism  by  offering  moral  support  and  helping  validate  his  beliefs. 
While  discussing  Hussain’s  role  in  the  Abdulkader  case,  however, 
Assistant  U.S.  Attorney  Timothy  Mangan  told  the  judge  that  Hus¬ 
sain  had  boasted  to  Abdulkader  about  his  involvement  in  directing 
the  Garland  attacks,  telling  him  “there’s  more  to  come.”54  Further¬ 
more,  in  December  2015,  FBI  Director  James  Comey  claimed  that 
on  the  day  of  the  attack,  one  of  the  gunmen  and  “an  overseas  terror¬ 
ist”  exchanged  109  encrypted  messages.  The  overseas  terrorist  was 
reportedly  believed  to  be  Hussain.  The  details  of  these  exchanges 
are  as  yet  unknown,  with  the  FBI  unable  to  access  them.55 

It  is  often  overlooked  that  Simpson’s  support  for  global  jihadism 
was  established  before  the  rise  of  the  Islamic  State.  In  2009,  he 
attempted  to  join  al-Shabaab  in  Somalia,  a  country  that  preceded 
Syria  as  the  prime  destination  for  Westerners  wishing  to  make  hi- 
jrah.56  His  interest  in  the  broader  movement  led  him  to  also  reach 
out  to  Miski  in  the  months  before  the  attack  in  Garland.57 

In  December  2014,  Miski  engaged  with  Simpson  via  Twitter  di¬ 
rect  messages  during  which  both  men  discussed  their  support  for 
the  January  2015  attacks  in  Paris  and  their  shared  admiration  for 
al-Awlaki.  It  appears  that,  among  other  things,  Simpson  was  us¬ 
ing  Miski  as  a  way  to  receive  advice  and  information  from  a  jihadi 
sheikh  with  connections  to  Miski.  On  December  7,  2014,  Simpson, 
using  his  Twitter  handle  @birdofgreen,  messaged  Miski’s  account 
@Muhajir_1436_Miski:  “Did  the  brother  interpret  the  dream  for 
you?  Or  not  yet.”  Miski  soon  responded,  telling  Simpson  that  “he 
said  the  Hoor  al-Ayn  is  waiting  for  you  eagerly.”58  The  Hoor  al-Ayn 
are  virgins  that  jihadi  ideologues  claim  are  promised  to  recruits 
who  carry  out  suicide  operations,  and  Miski’s  reference  to  this  is 
telling.  While  it  is  not  clear  what  Simpson’s  dream  was  about,  it 
can  be  reasonably  surmised  that  it  was  related  to  a  possible  oper¬ 
ation  he  had  discussed  with  Miski,  who  was  all  too  happy  to  offer 
encouragement. 

This  dialogue  was  the  first  of  at  least  two  conversations  about 
dream  interpretation.  In  the  second,  Miski  suggested  to  Simpson 
that  while  he  will  ‘loose  [sic]  an  opportunity  to  do  something  good 
like  Hijrah  ...  Allah  will  hold  you  back  for  something  far  better.”59 
While  cryptic,  this  too  suggests  that  Miski  was  pushing  Simpson 
in  the  direction  of  committing  a  domestic  attack.  This  is  further 
supported  by  another  conversation  days  later  when  Simpson 
asked  Miski,  “I  wonder  what  it  means  when  one  sees  imam  Anwar 
[al-Awlaki]  in  a  dream,”  to  which  Miski  responded,  “Maybe  he’s 
telling  you  what  he  told  Nidal,”  likely  referring  to  the  November  5, 
2009,  domestic  terrorist  attack  carried  out  by  Nidal  Hasan  in  Fort 
Hood,  Texas.60 

Miski  and  Simpson  also  communicated  via  Twitter  about  the 
gatheringin  Garland.  In  April  2015,  a  week  before  the  attack,  Simp¬ 
son  expressed  his  frustration  about  the  event  over  Twitter,  saying 
“When  will  they  ever  learn?  They  are  planning  on  selecting  the  best 
picture  drawn  of  Rasulullah  (saws)  [a  reference  to  the  Prophet  Mo¬ 
hammad]  in  Texas.”  Miski  soon  retweeted  the  message  and  also 
posted  his  own  statement  encouraging  Americans  to  attack  the 
event,  telling  his  followers  that  “The  brothers  from  the  Charlie  Heb- 
do  attack  did  their  part.  It’s  time  for  brothers  in  the  #US  to  do  their 
part.”61  This  was  a  reference  to  the  January  2015  al-Qa'ida-linked 
killings  at  the  offices  of  French  satirical  magazine  Charlie  Hebdo, 
known  for  its  frequent  depictions  of  the  Prophet  Mohammad. 

Miski’s  name  has  also  surfaced  in  several  other  cases  analyzed  in 


this  article.  It  has  been  reported  that  he  was  in  touch  with  Nicholas 
Rovinski,  who  was  convicted  for  his  role  in  the  plot  to  kill  an  orga¬ 
nizer  of  the  Mohammad  cartoon  contest.62  He  was  also  allegedly  an 
online  contact  of  the  young  New  Yorker  Saleh,  although  the  nature 
of  their  discussions  remains  unclear.63 

In  conjunction  with  the  aforementioned  American  jihadis,  court 
records  related  to  the  case  of  Abdi  Nur,  an  American  who  success¬ 
fully  traveled  to  join  the  Islamic  State  in  Syria,  show  that  he  too  had 
extensive  online  conversations  with  Miski.  They  were  both  from  the 
same  area  in  Minneapolis,  and  one  piece  of  advice  that  Miski,  an 
experienced  foreign  fighter,  imparted  to  his  friend  was  to  maintain 
close  contact  with  fellow  Americans  in  Syria.  According  to  Miski, 
this  was  because  “being  connected  in  Jihad  make  you  stronger  and 
you  can  all  help  each  other  by  fulfilling  the  duties  that  Allah  swt  (sic) 
put  over  you  . . .  Like  us  in  Somalia  the  brothers  from  mpls  [Minne¬ 
apolis]  are  well  connected  so  try  to  do  the  same  ...  It  is  something 
we  have  learned  after  6  years  in  Jihad.”64  Miski  is  also  named  as 
one  of  three  co-conspirators  with  whom  Keonna  Thomas,  a  con¬ 
vert  from  Pennsylvania,  discussed  her  desire  to  travel  to  Syria  and 
become  a  martyr.65 

Beyond  their  various  degrees  of  direct  contact  with  a  myriad  of 
radicalized  Americans,  the  impact  of  virtual  entrepreneurs,  while 
significant,  is  difficult  to  measure.  Their  activities  and  the  public 
profiles  they  cultivated  have  nonetheless  made  them  beacons  of 
inspiration  for  their  fellow  Western  jihadis,  many  of  whom  have 
no  doubt  been  motivated  after  witnessing  what  they  were  able  to 
achieve. 

Conclusion 

Social  media,  coupled  with  the  ever-increasing  availability  of  appli¬ 
cations  that  offer  encrypted  messaging,  has  given  virtual  entrepre¬ 
neurs  the  ability  to  both  bypass  Western  counterterrorism  measures 
and  build  close,  trusting  online  relationships  with  recruits.  As  a 
result,  virtual  entrepreneurs  have  come  to  be  seen  by  their  follow¬ 
ers  as  leadership  figures  from  whom  they  can  draw  inspiration  and 
take  advice  and  instruction  on  how  to  act  on  their  extreme  beliefs. 

Along  with  helping  to  inspire  radicalized  Westerners,  the  work 
of  Islamic  State  virtual  entrepreneurs  has  given  the  group  new  ways 
to  take  ownership  of  their  attacks,  ensuring  that  they  continue  to 
receive  attention  and  media  coverage.  Crucially,  virtual  entrepre¬ 
neurs  require  few  resources  and  offer  a  very  favorable  balance  be¬ 
tween  cost  and  benefit.  This  is  particularly  relevant  today  as  the 
Islamic  State  continues  to  lose  ground  in  Iraq  and  Syria  but  retains 
its  desire  to  remain  relevant  while  maintaining  a  significant  online 
presence  and  capability  to  strike  Western  targets.66 

It  is,  therefore,  no  surprise  that  this  trend  is  on  the  rise  through¬ 
out  the  West.  In  Europe,  the  strengthening  of  security  measures 
and  increased  military  pressure  have  made  it  difficult  for  people  to 
travel  and  join  the  Islamic  State  as  well  as  for  the  group  to  train  send 
operatives  back  home  to  conduct  attacks.  The  resulting  reduction  in 
the  flow  of  foreign  fighters  has  seen  virtual  entrepreneurs  favor  en¬ 
couraging  more  operations  in  European  nations  rather  than  help¬ 
ing  to  facilitate  travel.  In  a  recent  analysis  of  38  Islamic  State-linked 
plots  and  attacks  in  Europe  between  2014  and  October  2016, 19 
(50  percent)  were  found  to  have  involved  “online  instruction  from 
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members  of  IS’s  networks.”’ 

The  story  is  similar  in  the  United  States.  Since  2015,  as  seen  in 
the  cases  of  Abdulkader  and  Lutchman,  some  have  been  directed 
away  from  their  initial  intention  to  join  the  Islamic  State  by  virtual 
entrepreneurs  who  ask  them  to  instead  focus  on  domestic  attacks 
due  to  difficulties  associated  with  travel.  The  authors’  current  data 
shows  that  virtual  entrepreneurs  were  involved  in  21  percent  of  the 
total  38  plots  in  the  United  States  in  the  same  period  as  the  Europe¬ 
an  study.*1 1 2 3 4  While  this  number  is  lower — and  in  2016,  there  was  only 
one  documented  instance  of  a  virtual  entrepreneur  being  involved 
in  a  domestic  plot  (compared  to  six  in  2015)— it  may  change.  Due  to 
the  time  it  takes  for  cases  to  go  to  court,  it  will  be  some  time  before 
additional  details  come  to  light.  It  is  worth  noting  as  well  that  three 
of  the  most  influential  members  of  the  Legion — Hussain,  Hostey, 
and  Khan — were  killed  in  2015,  while  Miski  was  arrested  that  same 
year  and  al-Sudani  was  killed  in  mid-2016.  Whether  or  not  they  can 
be  replaced  remains  to  be  seen. 

There  are  a  number  of  factors  that  may  influence  this.  The  first 
of  these  is  whether  the  Islamic  State  and  other  jihadi  groups  intent 
on  striking  the  West  maintain  enough  territory  to  continue  har¬ 
boring  individuals  with  the  capability  to  inspire  and  plan  attacks 
via  the  internet.  While  virtual  entrepreneurs  can  technically  be 
just  as  effective  while  operating  outside  of  jihadi-held  territory,  it 
is  not  so  simple.  They  may,  for  example,  lose  credibility  in  the  eyes 
of  Western  jihadis  gained  by  the  likes  of  Hussain  and  Miski  who, 
due  to  their  locations,  were  able  to  present  themselves  as  legitimate 
members  of  terrorist  organizations.  This  potential  lack  of  safe  ha¬ 
vens  would  also  likely  make  virtual  entrepreneurs  more  vulnerable 
to  interception  by  Western  security  services. 


j  According  to  the  study,  a  further  “twelve  plots  can  with  a  high  degree  of 
certainty  be  linked  to  IS's  section  for  international  operations  and  the 
Abaaoud-network.  Nearly  all  of  [these  twelve]  involve  returning  foreign 
fighters."  Petter  Nesser,  Anne  Stenersen,  and  Emilie  Oftedal,  “Jihadi 
Terrorism  in  Europe:  The  IS-Effect,”  Perspectives  on  Terrorism  10:6  (2016). 

k  While  the  authors’  dataset  covers  an  additional  five  months  (up  to  March 
2017),  this  does  not  impact  the  figures. 


Second,  much  will  depend  on  how  both  Western  states  and 
technology  companies  deal  with  this  issue.  At  present,  it  remains 
somewhat  unclear  how  companies  offering  messenger  apps  with 
encryption  services  plan  to  respond.  While  Telegram  announced  in 
2015  that  it  had  shut  down  78  Islamic  State-related  unencrypted 
channels,  it  also  clarified  that  it  had  not  interfered  with  any  pri¬ 
vate,  encrypted  chats.1  When  asked  about  the  use  of  Telegram  by 
the  Islamic  State,  the  company’s  founder,  Pavel  Durov,  responded 
by  suggesting  that  it  was  a  regrettable  but  nonetheless  acceptable 
by-product  of  the  more  important  issue  of  offering  true  privacy  to 
internet  users.  “I  think  that  privacy,  ultimately,  and  our  right  for 
privacy  is  more  important  than  our  fear  of  bad  things  happening, 
like  terrorism,”  he  said.67 

In  the  traditional  policy  realm,  Western  states  continue  to  strug¬ 
gle  in  their  efforts  to  develop  effective  and  coherent  policies  on  com¬ 
bating  terrorist  use  of  the  internet.  In  Europe,  EUROPOL  has  set 
up  the  Internet  Referral  Unit  (EU  IRU).  According  to  EUROPOL 
Deputy  Director  Wil  van  Gemert,  it  “detects  terrorist  and  violent 
extremist  online  content,  flags  and  refers  such  content  to  internet 
providers,  and  asks  for  its  removal.”68  However,  it  is  not  clear  if  the 
EU  IRU  has  begun  to  look  into  encrypted  messaging  applications. 
In  the  United  States,  policy  is  still  taking  shape.  Under  the  previ¬ 
ous  administration,  government  officials  repeatedly  met  with  senior 
technology  company  executives,  urging  them  to  police  their  plat¬ 
forms  further  and  more  aggressively  enforce  their  terms  of  service.69 

As  the  response  to  this  threat  develops,  it  is  unlikely  the  world 
has  seen  the  end  of  virtual  entrepreneurs  with  the  deaths  of  Legion 
members  and  others  associated  with  them.  Their  recent  successes 
could  ensure  that  they  will  be  central  to  jihadi  groups’  current  and 
future  efforts  to  strike  the  West  while  continuing  to  pose  a  complex 
challenge  to  counterterrorism  authorities. 


I  The  announcement  was  made  on  Twitter  on  November  18,  2015.  Soon 
after,  a  user  asked  "Oh,  so  do  you  intercept  conversations?"  To  which  the 
official  Telegram  twitter  account  responded,  “No.  Channels  are  public  and 
available  to  everyone  by  default.” 
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The  Reina  Nightclub  Attack  and  the  Islamic 
State  Threat  to  Turkey 

By  Ahmet  S.  Yayla 


The  Reina  nightclub  attack  in  Istanbul  on  New  Year’s 
Eve  made  clear  the  immense  scale  of  the  Islamic  State 
threat  to  Turkey.  Investigations  have  shed  new  light  on 
the  group’s  command  and  control  over  sleeper  operatives 
in  Turkey  and  the  large  network  of  clandestine  cells 
and  logistical  and  financial  support  elements  it  has  set 
up  to  sustain  terrorist  activity.  Turkish  government 
complacency  has  allowed  the  threat  to  grow,  as  have 
purges  of  experienced  counterterrorism  professionals, 
including  those  after  last  year’s  failed  coup.  As  the 
Islamic  State  shows  signs  of  crumbling  in  Syria  and 
Iraq,  Turkey  now  faces  a  nightmare  scenario  of  a 
mass  influx  of  Islamic  State  fighters  into  its  territory. 


In  the  early  hours  of  January  1,  2017,  the  Islamic  State  took 
the  gloves  fully  off  in  its  terrorist  campaign  against  Turkey. 
A  single  gunman  gained  entry  to  the  Reina  nightclub  on 
the  Bosphorus,  a  famous  haunt  for  celebrities  and  Western 
tourists,  killing  39  and  wounding  71  before  escaping  into  the 
night.1  For  the  first  time  ever1  after  a  high-profile  attack  in  Turkey, 
the  Islamic  State  claimed  responsibility,  warning  “the  government 
of  Turkey  should  know  the  blood  of  Muslims,  which  it  is  targeting 
with  its  plane  and  guns,  will  cause  a  fire  in  its  home.”2 

On  January  16, 2017,  after  a  massive  manhunt,  the  attacker— lat- 


a  It  was  the  second  attack  in  Turkey  that  the  Islamic  State  claimed.  The  first 
was  a  car  bombing  in  southeastern  Turkey  in  November  2016.  Tim  Arango, 
“ISIS  Claims  Responsibility  for  Istanbul  Nightclub  Attack,"  New  York  Times, 
January  2, 2017. 
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er  identified  as  an  Uzbek  national  named  Abdulkadir  Masharipov 
(alias  Muhammed  Horasani)  from  a  small  town  in  Kyrgyzstan  with 
a  predominantly  Uzbeki  population3— was  finally  captured  alive  in 
the  Esenyurt  district  of  Istanbul.4  Investigations  revealed  he  had 
been  directed  to  launch  the  attack  by  a  senior  Islamic  State  oper¬ 
ative  in  Raqqa,  Syria,  and  had  been  provided  logistical  and  finan¬ 
cial  support  in  Istanbul  by  a  large  Islamic  State  network  operating 
clandestinely  in  the  city. 

This  article  examines  the  Reina  attack  and  subsequent  inves¬ 
tigations  for  implications  on  the  Islamic  State  threat  to  Turkey.  It 
then  explores  why  the  threat  has  grown  so  acutely  in  Turkey.  Giv¬ 
en  its  long  border  with  Syria  and  Iraq,  Turkey  was  always  likely  to 
experience  blowback  from  the  Syrian  civil  war  and  the  emergence 
of  the  Islamic  State  as  a  quasi-terrorist  state.  This  article  argues, 
however,  that  government  complacency  over  the  threat  allowed  it 
to  build  a  deeper  presence  and  wider  support  inside  Turkey.  It  will 
also  explain  how  Turkish  vulnerability  to  Islamic  State  terrorism 
has  been  accentuated  by  the  removal  of  many  experienced  counter¬ 
terrorism  professionals  following  last  year’s  coup  attempt.  Finally, 
the  article  looks  at  how  the  threat  to  Turkey  and  Europe  may  evolve 
in  the  future. 

The  Reina  Nightclub  Plot 

The  Reina  nightclub  attack  was  carried  out  eight  weeks  after  Islam¬ 
ic  State  leader  Abu  Bakr  al-Baghdadi  called  for  all-out  war  against 
Turkey.  In  an  audio  released  on  November  2,  2016,  al-Baghdadi 
stated,  “Turkey  entered  the  zone  of  your  operations,  so  attack  it, 
destroy  its  security,  and  sow  horror  within  it.  Put  it  on  your  list 
of  battlefields.  Turkey  entered  the  war  with  the  Islamic  State  with 
cover  and  protection  from  Crusader  jets.”5 

Al-Baghdadi  was  referring  to  the  Turkish  military  incursion  into 
northern  Syria,  which  had  been  launched  in  the  summer  of  2016 
and  was  then  bearing  down  on  the  Islamic  State  stronghold  of  al- 
Bab.  The  Turkish  push  deeper  into  Islamic  State-held  territory  from 
Jarabalus  to  al-Bab  appears  to  have  crossed  a  red  line  for  the  group. 
The  Islamic  State  had  previously  pursued  what  one  observer  labeled 
a  “calibrated  strategy”  against  Turkey.  This  involved  launching  at¬ 
tacks  aimed  at  fracture  points  in  Turkish  society  without  claiming 
responsibility  so  as  not  to  lose  its  battle  for  hearts  and  minds  or 
jeopardize  its  ability  to  use  Turkey  as  a  recruiting,  financing,  and 
logistics  base.6  The  fourth  issue  of  the  Rumiyah  magazine,  released 
on  December  7, 2016,  designated  Turkish  President  Tayyip  Erdogan 
and  Russian  President  Vladimir  Putin  as  the  two  leaders  “plotting 
against  Islam  together.”  On  December  22,  in  a  significant  escala¬ 
tion,  the  Islamic  State  released  a  video  of  two  Turkish  soldiers  being 
burned  to  death.7 

Three  days  later,  on  Christmas  day,  the  Islamic  State  activated 
Abdulkadir  Masharipov,  a  sleeper  operative  in  Turkey,  and  tasked 
him  with  carrying  out  an  act  of  larger  retaliation.  Born  in  1983, 
Masharipov  graduated  from  Fergana  State  University  in  Uzbeki- 
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A  view  of  the  Bosphorus  in  front  of  the  Reina  nightclub,  one  of  Istanbul’s  most  exclusive  party  spots,  early  on  January  1,  2017,  after  the 
New  Year’s  Eve  attack.  (Ozan  Kose/AFP/Getty  Images) 


stan  with  a  major  in  physics  and  a  minor  in  computer  science.8 
While  much  remains  unclear  about  his  jihadi  path,  Masharipov  has 
been  involved  with  jihadi  terrorist  organizations  since  2011  accord¬ 
ing  to  information  provided  to  Interpol  by  Uzbekistan,9  where  he 
was  a  known  terrorist  and  subject  to  a  national  arrest  warrant.10  He 
spoke  four  languages:  Uzbek,  Arabic,  Chinese,  and  Russian.11  After 
his  capture,  Masharipov  told  police  that  he  had  received  military 
training  at  an  al-Qa '  ida  camp  in  Afghanistan  after  traveling  there 
in  2010.12  At  some  later  point,  while  he  was  in  Pakistan,  Mashari¬ 
pov  became  a  member  of  the  Islamic  State,  pledging  allegiance  to 
al-Baghdadi.13b 

According  to  Masharipov’s  subsequent  account  to  interrogators, 
about  a  year  before  the  Reina  attack,  he  had  been  given  orders  by  an 
Islamic  State  emir  in  Raqqa  to  travel  to  Turkey  to  establish  himself, 
along  with  his  wife  and  two  children,  in  Konya— a  city  in  the  middle 
of  Turkey— and  await  further  orders.  It  is  not  clear  how  Mashar¬ 
ipov  established  contact  with  the  group  in  Syria.  As  no  evidence 
has  emerged  that  he  ever  traveled  to  Syria,  it  appears  that  at  some 
point  while  he  was  in  Pakistan,  he  established  remote  contact  with 
the  group’s  leadership  in  Syria.  According  to  his  statement  to  po¬ 
lice,  after  traveling  from  Pakistan,  Masharipov  was  arrested  inside 


b  Masharipov’s  wife,  Zarina  Nurullayeva,  subsequently  told  police  that 

Masharipov  pledged  allegiance  to  the  Islamic  State  and  al-Baghdadi  during 
the  period  in  which  they  were  living  in  Pakistan.  “ISIL  told  me  they  are 
taking  my  son  to  Iran:  Istanbul  nightclub  attacker's  wife,”  Hurriyet  Daily 
News,  February  7,  2017. 


Iran  and  detained  there  for  over  a  month  before  Iranian  authorities 
deported  him  in  January  2016  across  (a  likely  remote  part  of)  the 
Iranian-Turkish  border  without  informing  the  Turkish  police  or 
customs  agents.14 

According  to  Masharipov’s  testimony  to  the  Turkish  prosecutor, 
on  December  25, 2016,  he  was  directed,  via  the  messaging  app  Tele¬ 
gram,  by  an  Islamic  State  emir  in  Raqqa  he  knew  as  “Abu  Shuhada” 
to  launch  an  attack  on  New  Year’s  Eve  in  Istanbul.  Abu  Shuhada, 
Masharipov  said,  was  responsible  for  Islamic  State  operations  in 
Turkey.  Masharipov  added  that  he  discussed  the  details  of  the  attack 
and  his  plan  with  another  commander  in  Raqqa,  whom  he  knew  by 
the  alias  “Rahova,”  and  later  informed  Abu  Shuhada  via  Telegram 
that  he  was  ready  to  carry  out  the  attack.15 

After  traveling  with  his  wife  and  two  children  to  Istanbul, 
Masharipov  claimed  he  was  provided  an  AK-47  assault  rifle  with 
six  loaded  magazines  and  three  stun  grenades  before  the  attack  by 
an  Islamic  State  member,  whose  name  was  never  made  known  to 
him.c  The  delivery  was  remotely  arranged  by  Abu  Shuhada  and  was 
dropped  off  at  the  apartment  building  “Medikule  Residences”  in 
the  Zeytinburnu  district  of  Istanbul,  where  Masharipov  rented  a 
room  before  the  attack.  In  this  residence,  he  readied  his  rifle,  taped 
the  ammunition  magazines  together  into  pairs  to  save  time  when 


c  The  unknown  Islamic  State  member  who  delivered  the  weapons  was 
dressed  in  black  cloth  with  a  mask  covering  his  face,  but  his  eyes  were 
reportedly  indicative  of  someone  from  the  Caucasus  region.  Yuksel  Kog, 
“Reina  saldirgam  tutuklandi,”  DHA,  February  11,  2017. 
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changing  them  out  during  the  impending  attack,  and  then  put  all 
of  his  weapons  into  a  backpack.16 

After  his  arrest,  Masharipov  provided  the  password  to  his  email 
account  to  the  police,  and  among  his  emails,  the  police  found  a 
“martyrdom”  video  he  made,  recorded  by  his  wife,  Zarina  Nurulla- 
yeva,  on  December  27,  2016.17  In  this  video,  Masharipov  said  he  was 
going  to  carry  out  a  suicide  attack  in  the  name  of  the  Islamic  State. 
He  asked  his  children  to  behave  well  and  not  to  upset  their  mother 
after  he  was  gone,  and  he  requested  that  his  son  grow  up  to  become 
a  suicide  bomber  just  like  him.18 

In  the  safe  house  where  Masharipov  was  apprehended,  the  po¬ 
lice  also  found  a  tablet  computer.  According  to  the  prosecutor’s 
indictment,  the  police  recovered  a  voice  message  from  an  emir  in 
Raqqa,  who  appears  to  have  been  senior  to  Abu  Shuhada.  In  his 
message  sent  to  Masharipov,  the  senior  emir  gave  his  farewells  to 
Masharipov  and  guaranteed  him  that  his  family  was  going  to  be 
well-taken  care  of,  asking  him  not  to  worry  about  his  family  under 
any  circumstances.19 

Masharipov’s  target  was  Taksim  Square  in  Istanbul,  where  a 
large  public  gathering  was  expected  to  welcome  in  the  new  year. 
At  some  point  before  setting  out,  he  sent  Abu  Shuhada  target  re¬ 
connaissance  video  he  had  recorded  in  the  square  during  daylight 
hours.  He  said  Abu  Shuhada  then  gave  his  approval  over  Telegram 
from  Raqqa.  Even  before  the  Islamic  State  officially  claimed  the 
Reina  attack,  this  footage— later  labeled  a  “selfie  video”  by  interna¬ 
tional  media  because  Masharipov  surreptitiously  filmed  the  square 
while  turning  the  camera  on  himself— was  released  on  a  pro-Islam  - 
ic  State  Telegram  account,  which  claimed  the  perpetrator  “was  a 
lion  of  the  caliphate.”20 

But  when  Masharipov  arrived  at  the  square  around  midnight 
local  time,  he  aborted  the  attack  because  there  were  too  many  police 
officers  present.  Using  Telegram  on  his  cell  phone,  he  immediately 
communicated  this  decision  back  to  Abu  Shuhada  and  was  told  to 
look  for  an  alternate  target.  Already  familiar  with  the  Reina  night¬ 
club  and  observing,  as  he  passed  by  in  a  taxi,  that  it  was  not  well 
protected,  he  reported  to  Abu  Shuhada  it  could  be  a  possible  target. 
After  Abu  Shuhada  confirmed  Reina  as  the  new  target,  Mashari¬ 
pov  went  back  to  his  residence  in  Zeytinburnu  to  get  his  weapons 
and  stun  grenades  and  returned  to  Reina  via  taxi  to  carry  out  the 
attack.21 

“I  entered  Reina  to  die,”  Masharipov  later  told  interrogators.22 
The  way  he  carried  out  the  attack  made  clear  that  he  was  a  well- 
trained,  experienced,  and  battle-hardened  fighter.6  He  approached 
the  entrance,  killing  the  police  officer  located  there  without  any 
hesitation  and  then  entered  the  nightclub,  spraying  people  with 
his  automatic  assault  rifle.  He  remained  calm  as  the  revelers  pan¬ 
icked  and  screamed,  changing  the  magazines  five  times  without  any 
interruptions  or  apparent  excitement.  In  total,  he  shot  180  rounds, 
killing  and  wounding  his  victims  as  many  looked  him  in  the  eye.23 

“When  I  was  out  of  bullets,  I  threw  two  stun  grenades.  I  put 
the  third  one  near  my  face  to  commit  suicide,  but  I  didn’t  die.  I 
survived.  My  purpose  was  not  to  fall  hostage,”  he  later  told  Turk- 


d  His  “professionalism"  was  evidenced  by  his  use  of  tracer  ammunitions 
at  the  end  of  each  magazine  (as  a  reminder  to  reload  the  magazine)  and 
his  use  of  steelhead,  armor-piercing  ammunition.  Pinar  Hilal  Balta,  “Reina 
saldirgani  ‘profesyonel’  olabilir,"  Timeturk,  January  7,  2017;  Yuksel  Kog, 
“Reina  saldirgani  tutuklandi,"  DHA,  February  11,  2017. 


ish  investigators.24  After  fleeing  the  nightclub,  Masharipov  evaded 
capture  for  more  than  two  weeks.  He  was  captured  in  the  Esenyurt 
district  of  Istanbul  on  January  16,  2017,  and  detained  and  interro¬ 
gated  for  25  days  before  being  charged.25 

During  the  interrogations,  he  claimed  infidels  had  been  his  tar¬ 
get.26  “I  wanted  to  stage  the  attack  on  Christians  in  order  to  exact 
revenge  on  them  for  their  acts  committed  all  over  the  world,”  he  told 
an  interrogator.27  He  said  that  after  the  attack,  he  left  Reina  wound¬ 
ed  because  the  stun  grenade  had  exploded  in  his  hand.  He  crawled 
out  of  the  club  through  the  front  door,  pretending  that  he  was  one 
of  the  victims.  When  the  SWAT  team  officers  arrived  at  the  front 
gate,  they  believed  Masharipov  was  one  of  the  victims  and  handed 
him  over  to  other  police  officers  who  pulled  him  out  of  the  crowd 
toward  the  sidewalk  from  which  he  fled  seconds  later.28 

In  the  apartment  building  where  Masharipov  was  captured,  po¬ 
lice  found  two  aerial  drones,  two  handguns,  several  cell  phone  SIM 
cards,  and  $197,000  in  cash.29 

The  Reina  Attack  Support  Network 

Subsequent  investigations  established  that  Masharipov  was  provid¬ 
ed  support  on  the  ground  in  Istanbul  by  a  large  network.  After  the 
attack,  Masharipov  hid  in  five  different  safe  houses  before  he  was 
captured.30  He  was  apprehended  along  with  three  women  (Dina, 
27,  from  Senegal;  Aysha  M.,  27,  from  Somalia;  and  Tene  T.,  26, 
an  Egyptian-French  citizen)  as  well  as  an  Iraqi  man.  The  women 
were  allegedly  also  members  of  the  Islamic  State  and  sent  as  “gifts” 
to  him  after  the  attack.31  Masharipov  claimed  he  first  went  to  the 
Zincirlikuyu  neighborhood  to  hide,  meeting  with  a  Uighur  he  had 
become  acquainted  with  to  get  help  and  spend  the  night.  Afterward, 
he  went  to  Basaksehir  to  meet  with  another  Islamic  State  cell,  which 
resulted  in  the  leader  of  the  cell  taking  him  and  an  Iraqi  member  of 
the  group  to  a  prearranged  safe  house.  He  was  then  transferred  to 
another  safe  house,  which  was  considered  a  more  secure  place  in 
Esenyurt,  where  he  was  eventually  captured.32 

Masharipov  initially  had  had  his  son  with  him,  but  the  boy  was 
taken  from  him  by  an  Islamic  State  member,  according  to  Turkish 
court  documents.  Masharipov  was  allegedly  told  that  his  son  would 
be  given  back  to  him  when  it  was  time  to  leave  Istanbul.33  His  wife 
subsequently  claimed  that  their  son  was  taken  to  Iran.34 

Masharipov’s  wife  was  detained  in  an  operation  that  captured  11 
suspects  on  January  12,  2017-35  In  her  statement,  Nurullayeva  stated 
that  her  husband  left  their  Istanbul  lodgings  three  days  before  the 
attack  and  that  she  and  their  daughter  were  then  transferred  to  an 
Islamic  State  safe  house  by  Islamic  State  members.36  Nurullayeva 
and  her  two-year-old  daughter  stayed  in  hiding  in  such  places  as 
Basaksehir  and  Pendik  in  Istanbul.  It  was  later  revealed  that  Rus¬ 
sian  authorities  had  arrested  Nurullayeva  in  2011  on  charges  of  be¬ 
ing  a  member  of  a  terrorist  organization.376 

The  safe  house  where  Masharipov  was  hiding  when  he  was 
caught  was  supervised  by  a  suspected  Islamic  State  operative  “Mua- 


e  Bakhtiiar  Abdurashidov,  an  alleged  Islamic  State  member  who  was 
arrested  in  the  same  operation  that  captured  Nurullayeva,  was  accused 
of  facilitating  Masharipov’s  transfer  to  the  Pendik  safe  house.  Two  other 
suspects,  Adili  Salumi  and  Islam  Magomedov,  were  accused  of  being 
watchmen  for  the  safe  house.  Even  though  Salumi  had  been  blacklisted 
as  a  terrorist  and  banned  from  entering  Turkey,  he  had  managed  to  enter 
the  country  illegally.  “Reina  saldirganinm  esi  dahil  11  kisi  tutuklandi," 
Cumhuriyet,  February  3,  2017. 
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viye”  (code  name  “Abdurrauf  Sertin”),  who  was  arrested  on  January 
5,  2017,  in  a  raid  in  Zeytinburnu,  that  netted  several  alleged  key 
figures  in  the  Islamic  State’s  network  in  Istanbul.38  Muaviye  was 
allegedly  supervising  several  safe  houses  in  Istanbul.39f  Also  arrest¬ 
ed  was  “Abu  Jihad”  (alias  “Yasser  Mohammed  Salem  Radown”)  the 
Islamic  State’s  alleged  qadi  (judge)  for  Istanbul.8  Abu  Jihad  had 
been  sent  to  Turkey  by  the  group  after  serving  as  a  qacli  in  differ¬ 
ent  Islamic  State  territories.40  A  third  man  arrested  in  the  raid  was 
Maitibake  Tusunmaimaiti,  an  Islamic  State  operative  who  had  been 
in  touch  with  Masharipov  before  and  after  the  attack.41  Tusunmai¬ 
maiti  had  $159,380  in  his  possession  at  the  location  where  he  was 
caught  and  was,  according  to  the  Turkish  prosecutor,  supervising 
Islamic  State  operatives  based  at  12  terrorist  hideouts  who  were 
working  to  shelter  foreign  fighters  in  Istanbul.  The  police  also  found 
an  additional  $150,000  at  a  different  house  where  Tusunmaimaiti 
was  staying,  revealing  just  how  deep  the  financial  pockets  of  the 
network  supporting  the  Reina  attack  were.42  h  Abdullah  Turkistanli, 
a  fourth  operative  caught  in  the  same  operation,  was,  according  to 
a  Turkish  prosecutor,  the  emir  in  charge  of  Islamic  State  operatives 
based  at  60  terrorist  hideouts  housing  foreign  fighters  in  Istanbul.43 

Based  on  the  author’s  research  and  personal  experience  in¬ 
vestigating  terrorist  hideouts  in  Turkey,  each  location  is  typically 
manned  by  two  to  three  armed  fighters  and  is  often  protected  with 
booby-traps.  Typically  only  one  individual  in  these  micro-cells  is 
responsible  for  communicating  with  his  emir  via  encrypted  mes¬ 
saging  systems  such  as  Signal  or  Telegram.  By  this  arithmetic,  a 
single  emir  like  Turkistanli  could  have  been  overseeing  over  100 
fighters  loyal  to  the  Islamic  State  in  Istanbul,  which  gives  a  sense  of 
the  scale  of  the  group’s  presence  in  Turkey’s  largest  city.  Thus  far,  the 
investigations  into  the  Reina  attack  have  revealed  that  more  than 
50  individuals  directly  provided  support  to  Masharipov  before  and 
after  the  attack.'  Almost  all  of  those  arrested  were  from  the  Cauca¬ 
sus  region  and  Central  Asia,  and  many  were  Russian  speakers.44  Po¬ 
lice  operations  also  revealed  the  presence  of  almost  100  safe  houses 
operated  by  the  Islamic  State  in  Istanbul.  An  unknown  number  re¬ 
main  undiscovered.  The  investigations  have  also  revealed  just  how 
cash  rich  the  group  is  inside  of  Turkey.  In  total,  just  over  $500,000 
was  confiscated  by  the  authorities  from  the  network  linked  to  the 
attack,  a  clear  indication  of  the  priority  given  to  international  oper¬ 
ations  by  Islamic  State  decision-makers.45 

The  Islamic  State’s  Network  in  Turkey 

The  Istanbul-based  network,  which  provided  support  to  the  Reina 
attacker,  was  just  one  part  of  a  web  of  cells  that  the  Islamic  State 


f  Islamic  State  safe  houses  are  typically  leased  by  individuals  who  do  not 
reside  in  them. 

g  Ten  foreigners  in  the  process  of  being  transferred  to  Syria  were  captured 
in  the  same  raid.  None  of  them  had  passports.  “DEAS’in  ‘kadi'si  Ebu  Cihad 
kod  isimli  Yasser  Mohammed  Salem  Radown  tutuklandi,”  Haberturk, 
January  25, 2017. 

h  In  the  Istanbul  operations  targeting  the  network  behind  the  Reina  attack, 
more  than  $500,000  in  cash  has  been  recovered  so  far  from  the  cells 
and  safe  houses  raided,  a  clear  indication  of  the  steady  flow  of  cash  for 
operations. 

i  More  than  50  terrorists  were  arrested  due  to  their  ties  with  the  Reina 
attack,  and  the  police  took  legal  action  against  168  foreigners  in  a  larger 
net.  Angela  Dewan  and  Emily  Smith,  “Istanbul  nightclub  attack  suspect 
confesses,  governor  says,”  CNN,  January  17, 2017. 


Screen  captures  from  the  “selfie  video”  showing  alleged  Reina 
nightclub  attacker Abdulkadir  Masharipov  in  Taksim  Square. 

The  reconnaissance  video,  which  Masharipov  told  interrogators 
he  uploaded  to  his  Islamic  State  handler  in  Raqqa,  Syria,  was 
first  released  on  a  pro-Islamic  State  Telegram  account  after  the 
attack. 

maintains  in  Turkey.  The  group  has  thus  far  recruited  around  3,000 
active  Turkish  fighters  in  Syria  and  Iraq.  It  has  also  established  a 
vast  and  sustainable  network  within  Turkey  through  the  involve¬ 
ment  of  mostly  Turkish  individuals,  but  also  a  significant  number 
of  foreign  operatives.  This  network  remains  involved  in  recruitment 
activities;  arranging  and  providing  logistical  support  to  Islamic 
State  operations;  financial  operations;  and  the  establishment  of 
numerous  terrorist  cells  and  safe  havens  inside  Turkey.46  No  official 
numbers  exist  on  the  scale  of  the  Islamic  State  presence  in  Turkey, 
and  any  estimates  are  very  tentative.  But  based  on  the  author’s  re¬ 
search  and  data  available  on  the  number  of  terrorist  hideouts  in 
Turkey,  there  may  be  as  many  as  2,000  hardcore  fighters  loyal  to 
the  Islamic  State  inside  Turkey. 

The  network  in  Turkey  includes  attack  units  composed  of  Turk¬ 
ish  and  foreign-established  cells  in  different  cities  around  the  coun¬ 
try,  intelligence  units  (the  emni*7),  logistical  support  units,  border 
units,  communication,  and  finance  units,  and  a  variety  of  other 
sympat  hizers  playing  supportive  roles.  Most  of  these  structures  are 
overseen  by  city  emirs  who,  in  turn,  report  up  to  regional  emirs.  In 
contrast,  the  emni  and  attack  cells  are  directly  tied  to  the  Islam¬ 
ic  State’s  center  in  Raqqa,  Syria,  rather  than  being  linked  to  each 
other,  making  it  impossible  for  them  to  give  up  information  about 
other  cells.48 

There  are  two  types  of  cell  structures  working  for  the  Islamic 
State  in  Turkey.  The  first  are  the  local,  Turkish  cells,  which  tend 
to  be  more  loose-knit  and  less  experienced  than  the  foreign  cells 
based  in  Turkey.  They  have  tended  to  carry  out  suicide  bombings 
rather  than  gun  attacks,  likely  because  they  are  less  experienced  in 
urban  warfare.  One  example  was  the  “Dokumaci  network,”  which 
in  2015  carried  out  bombings  in  Diyarbakir,  Suruc,  and  a  Kurdish 
and  opposition  rally  in  Ankara,  killing  a  total  of  over  130.49 

The  second  type  of  cell  structure  is  composed  of  foreign  fight¬ 
ers.  They  tend  not  to  mix  with  the  local  cells  and  have,  so  far,  been 
staffed  mostly  by  fighters  from  Caucasus  countries,  including 
Dagestan,  Chechnya,  and  Ingushetia,  as  well  as  Uighur  Turks  and 
Central  Asians  from  the  former  Soviet  bloc.  Almost  all  of  these 
fighters  speak  Russian,  making  it  easy  for  them  to  work  together.50 
Islamic  State  defectors  interviewed  by  the  author  have  said  that  the 
Caucasian  contingent  within  the  Islamic  State  has  a  reputation  as 
being  the  most  formidable  of  the  group  s  fighters.51  It  is  possible  that 
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the  Islamic  State  has  used  these  foreign  fighters  for  attacks  inside 
Turkey  because  they  have  fewer  local  ties,  making  it  easier  for  them 
to  be  persuaded  to  launch  attacks  and  operate  clandestinely. 

As  has  been  outlined,  Caucasian  and  Central  Asian  foreign  fight¬ 
ers  played  a  key  role  in  the  Reina  nightclub  attack.  Operatives  from 
the  region  also  played  a  critical  role  in  the  gun  and  suicide  bomb 
assault  on  Istanbul  airport  on  June  28,  2016.  This  was  carried  out 
by  two  Russian  citizens  from  Dagestan,  Rakim  Bulgarov  and  Vadim 
Osmanov,  who  entered  the  country  legally  a  month  before  the  at¬ 
tack;  the  identity  of  the  third  attacker  and  his  country  of  origin  has 
yet  to  be  shared  with  the  public.52  The  mastermind  of  the  attack  was 
allegedly  Akhmed  Rajapovich  Chatayev,  a  senior  Chechen  Islamic 
State  commander  who  lived  in  Turkey  between  2013  and  2015  and 
is  believed  to  have  previously  worked  to  target  Turkish  interests, 
who  continues  to  pose  a  threat  to  Turkey  and  other  nations  from 
Syria.53 

As  illustrated  by  the  Reina  attack,  the  foreign  cells  also  main¬ 
tain  a  large  number  of  safe  houses  in  which  to  hide  foreign  Islamic 
State  members.  The  safe  houses  are  essential  to  the  Islamic  States 
efforts  to  move  terrorists  around  the  country  and  back  and  forth  to 
the  Islamic  State  territories.  In  the  aftermath  of  the  Reina  attack, 
almost  100  Islamic  State  safe  houses  were  uncovered,  many  of  them 
in  Istanbul.54  Istanbul  has  been  the  main  location  for  Islamic  State 
safe  houses  because  it  is  the  main  arrival  hub  for  foreign  fighters. 
But  the  network  of  safe  houses  is  spread  across  the  country  and  is 
present  in  such  major  cities  as  Ankara,  Izmir,  Kocaeli,  and  Konya 
as  well  as  the  border  towns  of  Gaziantep,  Sanliurfa,  Kilis,  and  Hatay 
where  foreign  fighters  hide  and  wait  for  their  turn  to  be  smuggled 
into  Syria.55 

It  has  recently  come  to  light  that  the  Islamic  State  has  also  been 
operating  training  centers  in  Turkey.  In  early  March,  court  filings 
revealed  the  Islamic  State  ran  four  separate  training  centers  and 
schools  in  the  towns  of  Sincan,  Altmdag,  Etimesgut,  and  Cubuk  in 
Ankara  province,  which  were  used  to  train  Turkish  youth  to  become 
Islamic  State  militants.56  The  investigation  into  the  Istanbul  airport 
attack  has  revealed  the  Islamic  State  ran  a  training  center,  which 
airport  attacker  Vadim  Osmanov  attended.  This  center  was  used 
for  the  initial  and  entry-level  training  of  foreign  fighters  coming  to 
Turkey  to  join  the  Islamic  State  and  also  to  arrange  their  transfers 
to  Syria.57 

Islamic  State  activity  in  Turkey  has  taken  a  variety  of  other 
forms.  As  noted  in  reports  by  the  European  Union-funded  Conflict 
Armament  Research  (CAR),  “Turkey  is  the  most  important  choke 
point  for  components  used  in  the  manufacture  of  IEDs”  by  the  Is¬ 
lamic  State.58  In  fact,  CAR  reports  assessed  that  Islamic  State  “forc¬ 
es  source  most  of  the  products  used  in  the  manufacture  of  weapons 
and  ammunition  from  the  Turkish  domestic  market.”59  Similarly, 
thousands  of  Islamic  State  and  other  jihadi  fighters — including 
one  of  al-Baghdadi’s  deputies,  Ahmet  el-H— received  free  medical 
treatment  in  Sanliurfa  and  other  Turkish  cities.60  The  Islamic  State 
was  also  able  to  establish  a  secret  factory  in  Turkey  where  it  has 
produced  a  large  number  of  uniforms  for  its  fighters61  and  hun¬ 
dreds  of  suicide  vests,62  ensuring  the  uninterrupted  flow  of  needed 
materials. 

The  Slow  Turkish  Response 

The  threat  now  facing  Turkey  is  self-inflicted  to  some  degree.  The 
Islamic  State  was  able  to  establish  such  an  extensive  network  in 
Turkey  because  Turkey  was  complacent  about  the  threat— for  exam¬ 


ple,  President  Erdogan’s  hesitancy  to  blame  the  Islamic  State  as  the 
terrorist  organization  behind  attacks  until  the  June  2016  Istanbul 
airport  attack.63  Ankara  was  prepared  to  tolerate  a  certain  degree  of 
Islamic  State  activity  on  its  soil  and  on  its  border  with  Syria  because 
it  was  seen  as  an  enemy  to  the  Assad  regime  and  to  Kurdish  fighters 
linked  to  the  PKK  rather  than  a  direct  threat  to  Turkish  national 
security.  Another  factor  slowing  the  response  to  the  Islamic  State 
threat  has  been  the  long-held  view  by  Turkey’s  security  establish¬ 
ment  that  the  PKK  is  a  greater  threat  to  the  country  than  Islamists. 
In  2014  and  2015,  Turkey  did  not  carry  out  a  single  pre-planned, 
intelligence-led  counterterrorism  operation  on  its  soil  against  the 
Islamic  State  and  other  jihadi  terrorist  organizations.  Even  in  2016, 
when  Turkey  started  treating  the  threat  more  seriously,  counterter¬ 
rorism  operations  were  mostly  launched  in  reaction  to  different  ter¬ 
rorist  incidents,  and  in  most  cases,  suspects  were  released  swiftly.64 

Until  the  beginning  of  2016,  Turkey  did  little  to  stop  or  interrupt 
the  flow  of  foreign  fighters  going  back  and  forth  across  the  Turkish 
border,65  resulting  in  over  25,000  foreign  fighters66  joining  Islamic 
State  ranks  through  this  route. 

As  the  civil  war  in  Syria  escalated,  the  author  (who  directed 
counterterrorism  operations  in  the  border  town  of  Sanliurfa  until 
2014)  witnessed  firsthand  Turkey’s  southern  borders  being  over¬ 
whelmed  with  refugees  fleeing  from  Syria— over  three  million — 
who  were  let  in  regardless  of  their  background.67  In  fact,  the  influx 
of  refugees  was  so  overwhelming  that  it  became  a  major  security 
concern  for  border  cities  because  of  the  opportunities  it  provided 
the  Islamic  State  to  infiltrate  operatives  into  Turkey.  Sanliurfa  alone 
received  more  than  400,000  refugees  in  just  20  months.  By  the 
time  it  declared  a  caliphate  in  June  2014, 68  the  Islamic  State  was 
essentially  the  main  southern  neighbor  of  Turkey.69  In  the  months 
that  followed,  it  strengthened  its  control  of  major  border  areas  and 
thereby  its  ability  to  transport  material  and  foreign  fighter  move¬ 
ments  back  and  forth  across  the  border. 

The  lack  of  full-throated  condemnation  of  the  Islamic  State 
among  Turkey’s  political  class1  and  the  significant  level  of  popu¬ 
lar  approval  in  Turkey  for  fighters  confronting  the  Assad  regime 
allowed  the  group  to  gain  a  degree  of  support  inside  Turkey.  In 
2015,  public  opinion  research  found  eight  percent  of  the  Turkish 
population  had  a  favorable  opinion  of  the  Islamic  State.70  Islamic 
State  supporters  inside  Turkey  have  openly  celebrated  attacks  in  the 
West,  for  example  parading  openly  and  tweeting  in  celebration  after 
the  July  2016  Nice  truck  attack.71  Even  more  disturbingly,  as  late  as 
2015,  extremist  preachers  were  allowed  to  organize  gatherings  for 
Islamic  State  supporters  to  openly  support  the  group  in  front  of  the 
media.  One  aggressively  pro-Islamic  State  Turkish  preacher,  Abu 
Hanzala,  who  lives  openly  in  Turkey,  can  be  heard  on  a  YouTube 
video  saying  “anyone  who  supports  the  fight  against  ISIS,  he  is  an 
infidel  for  sure.”72 

Although  Ankara  is  now  treating  the  threat  from  the  Islamic 
State  more  seriously,  the  Turkish  government’s  current  focus  on 
countering  domestic  political  opponents  suggests  it  has  not  yet  rec¬ 
ognized  the  gravity  of  the  situation. 


j  For  example,  Prime  Minister  Ahmet  Davudoglu  referred  to  the  Islamic  State 
as  a  “bunch  of  frustrated  young  guys"  and  failed  to  condemn  them  in  public 
speeches.  “Davutoglu  ISID'e  yine  ‘terorist’  diyemedi,  'mesrulastirici'  laflar 
etti,”  Diken,  August  7,  2014. 
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Curtailed  Counterterrorism  Capacity 

The  Islamic  State  threat  to  Turkey  has  been  exacerbated  by  a  series 
of  purges  of  experienced  police  and  security  officials  that  has  seri¬ 
ously  degraded  Turkeys  counterterrorism  capabilities.  Following 
the  sensational  corruption  charges  against  senior  figures  in  then 
Prime  Minister  Erdogan’s  party  in  December  2013,  the  ruling  party 
moved  to  purge  and  arrest  all  of  the  police  chiefs  and  officers,  prose¬ 
cutors  and  judges  they  perceived  to  be  involved.73  Within  the  Turk¬ 
ish  national  police,  senior  officers  in  counterterrorism,  intelligence, 
and  organized  crime  divisions  in  the  Istanbul  Police  Department 
were  fired  and  replaced.74 

After  the  failed  coup  on  July  15,  2016,  the  purges  only  acceler¬ 
ated.  More  than  125,000  government  officials,  including  military 
officers,  police  officers,  judges,  prosecutors,  and  academics,  were 
removed  from  office,  of  which  almost  40,000  were  arrested.75  The 
top  ranks  of  the  military  were  also  targeted,  with  half  of  its  active 
duty  generals  removed.  The  Turkish  National  Police  lost  more  than 
20,000  officers  in  the  period  since  late  2013,  including  police  chiefs 
and  officers  who  had  spent  years  in  the  field  fighting  terrorism;  they 
were  either  fired  or,  in  many  cases,  arrested.  In  the  judiciary,  a  third 
of  prosecutors  and  judges  were  fired  and/or  arrested,  a  number  well 
over  4,000.76  All  of  this  has  resulted  in  Turkey  losing  its  most  expe¬ 
rienced  manpower  and  a  great  deal  of  institutional  knowledge  in 
the  fight  against  terrorism  as  most  of  the  newly  appointed  police 
have  never  worked  in  counterterrorism-related  jobs  and  do  not 
have  the  necessary  skills  and  training. 

The  Future  Threat 

The  Islamic  State  will  likely  expand  its  campaign  of  attacks  in  Tur¬ 
key.  In  the  fifth  issue  of  the  Rumiyah  magazine,  issued  on  January 
6,  2017,  the  group  stated  the  country’s  NATO  membership,  secular 
governance,  security  operations  against  Islamic  State  operatives  on 
Turkish  soil,  support  for  the  Shi '  a-dominated  government  in  Bagh¬ 
dad,  and  incursion  into  Islamic  State  territory  in  Syria  meant  war. 

The  investigations  into  the  Reina  nightclub  attack  reveal  just 
how  large  of  a  presence  the  Islamic  State  now  has  inside  Turkey, 
with  a  network  of  50  with  access  to  half  a  million  dollars  proving 
support  to  the  attacker.  The  group  appears  to  currently  have  the 
capacity  to  wage  a  sustained  campaign  of  terrorism  in  Turkey  by 
ordering  operatives  already  on  Turkish  soil  to  move  forward  with 
attacks  and  providing  them  with  the  financial  and  logistical  assis¬ 
tance  they  need  through  support  networks  on  the  ground.  Mashar- 
ipov’s  case  shows  how  senior  Islamic  State  operatives  in  Syria 
are  now  able  to  manage  every  aspect  of  terrorist  attack  planning 
through  encrypted  communications.  This  is  allowing  them  not  only 
to  direct  terrorist  plotters  like  Masharipov  in  real  time  but  also  to 
arrange  for  weapons,  supplies,  and  hiding  places  to  be  provided  to 
such  plotters.  Such  coordination  has  also  been  noted  in  the  groups 
terrorist  plots  against  Europe,77  but  the  group’s  large  presence  in 
Turkish  cities  means  that  it  has  a  much  larger  support  infrastruc¬ 
ture  there  for  terrorism. 

The  investigations  also  show  there  are  true  sleeper  cells  in  Tur¬ 
key  with  almost  a  year  elapsing  between  Masharipov  being  dis¬ 
patched  to  the  country  and  the  attack’s  launch.  During  this  time, 
he  settled  into  a  Turkish  city  with  his  wife  and  two  children  and 
kept  no  connections,  as  far  as  is  known,  to  local  Turkish  cells.  This 
high  level  of  operational  security  is  concerning  to  counterterrorism 
officials.  There  are  likely  dozens  of  known  and  unknown  established 
cells  throughout  Turkey,  with  several  likely  awaiting  activation  by 


the  Islamic  State. 

A  sustained  campaign  of  attacks  by  the  Islamic  State  could  lead 
to  large-scale  loss  of  life  and  significant  damage  to  the  Turkish  econ¬ 
omy.  The  targeting  of  a  nightclub  popular  with  foreigners  suggests 
Western  diplomatic,  commercial  facilities,  and  tourists  could  all 
emerge  as  primary  targets. 

The  Islamic  State  still  has  a  large  support  base  among  Turks,78 
providing  the  group  with  continued  recruitment  opportunities 
and  operational  advantages,  though  it  is  possible  a  surge  in  at¬ 
tacks  could  create  a  backlash.  Although  the  Islamic  State  has  been 
pushed  back  from  areas  on  the  Turkish  border,  it  will  still  likely  be 
able  to  find  ways  to  send  operatives  directly  from  Syria  to  carry  out 
attacks.  The  Turkish  counterterrorism  apparatus  has  been  critically 
damaged,  crippling  the  police’s  counterterrorism  and  intelligence 
departments  and  leaving  Turkey  vulnerable  to  a  variety  of  future 
terrorist  attacks.  And  the  government  has  yet  to  make  repairing 
that  capability  a  priority,  raising  questions  of  its  understanding  of 
and  commitment  to  tackling  the  Islamic  State  threat. 

One  possibility  that  should  not  be  discounted,  given  the  fighting 
between  Kurdish  forces  and  the  Islamic  State  in  Syria  and  Iraq,  is 
fighting  erupting  between  PKK  supporters  and  Islamic  State  sup¬ 
porters  inside  Turkey  as  happened  during  the  1990s  between  the 
PKK  and  Turkish  Hezbollah.79  It  is  also  possible  that  the  Islamic 
State  and  the  PKK  could  independently  and  simultaneously  decide 
to  increase  the  frequency  of  their  attacks  in  Turkey,  taking  advan¬ 
tage  of  the  current  situation  and  forcing  Turkey  to  defend  itself  with 
poorly  trained,  inexperienced,  and  unprepared  counterterrorism 
and  intelligence-gathering  forces. 

The  nightmare  scenario  for  Turkey  is  a  mass  influx  of  Islamic 
State  operatives  across  its  border.  As  Iraqi  forces  advance  in  Mo¬ 
sul  and  coalition-backed  forces  push  toward  Raqqa,  there  is  no 
question  that  many  Islamic  State  members  fleeing  from  these  cit¬ 
ies — including  Syrians,  Iraqis,  Turks,  and  a  variety  of  other  nation¬ 
als— will  end  up  in  Turkey,  considerably  increasing  the  likelihood 
of  the  establishment  of  new  terrorist  cells  and  new  attacks.  Several 
defectors  the  author  has  interviewed80  indicated  that  Islamic  State 
commanders  have  decided  in  the  worst  case  scenario  to  instruct 
their  fighters  to  shave  their  beards  and  cut  their  hair  to  blend  into 
societies  in  close  proximity,  with  Turkey  being  the  nearest.  Syrian 
Islamic  State  fighters  traveling  to  Turkey  under  such  a  scenario  may 
be  able  to  pass  themselves  off  as  refugees,  given  the  country  already 
has  three  million  Syrian  refugees.  In  such  a  scenario,  the  current 
Islamic  State  infrastructure  in  Turkey  used  to  facilitate  the  transfer 
of  foreign  fighters  from  Europe,  Asia,  and  Northern  African  coun¬ 
tries  to  Syria  through  Turkey  would  likely  be  mobilized  to  reverse 
the  direction  of  travel  flows. 

A  surge  in  the  number  of  Islamic  State  fighters  inside  Turkey 
could  also  threaten  Europe,  particularly  given  the  significant  num¬ 
ber  of  those  involved  in  Islamic  State  attacks  and  plots  in  Europe 
who  traveled  back  through  Turkey.  Other  countries  around  the 
world  could  also  be  threatened  because  of  Istanbul’s  many  inter¬ 
national  air  connections. 

Turkey’s  counterterrorism  capacity  is  vital  for  both  the  country 
itself  and  the  West,  including  European  countries,  NATO  mem¬ 
bers,  and  even  the  United  States.  A  failed  or  unsuccessful  Turkish 
counterterrorism  apparatus  threatens  not  only  Ankara  but  every 
European  capital  as  well. 
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German  Foreign  Fighters  in  Syria  and  Iraq: 
The  Updated  Data  and  its  Implications 

By  Daniel  H.  Heinke 


German  security  authorities  have  collected  and 
analyzed  data  on  the  majority  of  the  910  individuals  who 
traveled  to  Syria  or  Iraq  based  on  Islamist  motivations, 
the  largest  such  study  conducted  by  any  Western 
government.  The  analysis  confirms  earlier  findings 
that  there  is  no  typical  socio-demographic  profile  of 
jihadi  terrorists  and  foreign  fighters.  With  a  growing 
threat  emanating  from  returning  foreign  fighters,  the 
counterterrorism  response  needs  to  be  both  multifaceted 
and  specific,  tailoring  approaches  to  certain  sub-groups 
such  as  minors,  women,  converts,  and  immigrants. 


The  fact  that  “Germany  is  increasingly  in  the  crosshairs 
of  the  Islamic  State”1  was  underscored  by  the  Decem¬ 
ber  19,  2016,  terror  attack  against  a  Christmas  market 
in  Berlin.  Although  the  truck  attacker,  Anis  Amri,  did 
not  spend  time  with  a  terrorist  group  overseas,  pre¬ 
liminary  investigation  results  indicate  he  had  contact  with  a  radical 
network  in  Germany  that  recruited  a  significant  number  of  German 
nationals  and  residents  for  the  Islamic  State  in  Syria  and  Iraq.2 

The  official  current  estimate  is  that  more  than  910  Islamists  have 
left  Germany  for  Syria  or  Iraq  since  2012,  although  it  has  not  been 
possible  in  all  cases  to  verify  that  these  individuals  did  indeed  reach 
their  destination.  About  one-third  of  those  who  departed  to  join 
the  Islamic  State  or  other  Islamist  factions  are  known  to  be  or  as¬ 
sumed  to  be  back  in  Germany.  More  than  70  of  these  returnees  have 
experienced  armed  combat  with  the  Islamic  State  or  at  least  have 
undergone  some  type  of  military  training.  About  145  Islamists  from 
Germany  are  presumed  to  have  been  killed  in  the  conflict  so  far.1 

German  security  authorities  (i.e.  the  police  and  domestic  intel¬ 
ligence  agencies  at  both  the  Lander  (states)  and  the  federal  level 
(including  the  agency  headed  by  the  author— the  Criminal  Police 
Bureau,  Bremen  Police)  jointly  collected  and  aggregated  informa¬ 
tion  about  784  individuals  who  had  departed  Germany  to  travel  to 
Syria  or  Iraq  before  June  30,  2016.  This  analysis3  was  conducted 


a  This  is  as  of  March  1,  2017.  (Source:  Ministry  of  the  Interior,  Free  Hanseatic 
City  of  Bremen,  Germany). 
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by  a  task  force  set  up  by  the  Bundeskriminalamt  (Federal  Crimi¬ 
nal  Police  Agency),  the  Bundesamtfur  Verfassungsschutz  (Federal 
Domestic  Intelligence  Service),  and  the  Hessisches  Informations- 
und  Kompetenzzentrum  gegen  Extremismus  (Hessian  Center  for 
Information  and  Expertise  on  Extremism). 

This  article  outlines  and  discusses  the  findings  of  the  official 
study  and  examines  what  the  data  means  for  the  threat  moving  for¬ 
ward  in  Germany.  It  updates  an  article  co-authored  two  years  ago 
in  this  publication  by  the  author,  which  was  based  on  early  official 
data  about  German  foreign  fighters'3  in  Syria  and  Iraq.4 

The  Foreign  Fighter  Flow 

Significant  numbers  of  individuals  began  traveling  to  Syria  or  Iraq 
because  of  an  Islamist  motivation  in  around  2012/2013,  reaching  a 
first  peak  by  the  third  quarter  of  2013  according  to  the  official  data. 
After  a  decline  in  the  rate  of  departures  over  the  next  months,  the 
numbers  peaked  again  in  the  second  quarter  of  2014,  coinciding 
with  the  proclamation  of  the  caliphate  by  the  Islamic  State  on  June 
29,  2014,  and  remained  relatively  high  during  the  rest  of  the  year. 
The  rate  of  departures  dropped  significantly  in  2015,  however,  and 
has  been  further  declining  since  that  time.  For  the  past  year,  the 
number  of  monthly  departures  averaged  around  five,  compared  to 
100  at  the  peak. 

Demographics 

It  remains  difficult  to  identify  a  clear-cut  “target  group”  for  jihadi 
radicalization.  Various  studies  analyzing  so-called  jihadis  in  the 
Western  world  (i.e.  violent  extremists  claiming  an  affiliation  with 
Islam)  with  a  focus  on  shared  analysis  of  investigations  of  executed 
or  prevented  terrorist  attacks  have  been  published  in  the  past  years, 
but  time  and  again,  such  studies  confirm  the  existing  intelligence 
does  not  support  a  reliable  socio-demographic  profile  of  jihadis.5 

The  departees  included  in  the  official  data  are  79%  male  and 
21%  female.  The  share  of  female  departees  rose  significantly  af¬ 
ter  the  proclamation  of  the  caliphate  in  June  2014,  climbing  from 
just  15%  before  the  proclamation  to  38%  in  the  first  year  of  the 
post-proclamation  phase;  since  then,  it  has  fallen  to  27%.  This  still 
very  large  contingent  of  female  extremists  constitutes  an  exception¬ 
al  phenomenon  not  previously  encountered,  at  least  on  this  scale, 
with  regard  to  jihadism  in  the  West.6 

The  age  range  of  the  departees  is  13  to  62  years,  with  an  arith¬ 
metic  mean  age  of  25.8  years.  The  age  bracket  22-25  years  provides 
for  the  largest  group  (322  individuals),  with  another  164  departees 
between  18  and  21  years,  and  143  in  the  26-29  years  bracket.  Again, 
there  are  considerable  differences  between  the  groups  who  had  de- 


b  For  purposes  of  this  article,  German  foreign  fighters  include  all  Islamists 
who  traveled  or  attempted  to  travel  to  jihadi  battlegrounds  overseas  from 
Germany,  including  German  nationals  and  residents. 
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parted  prior  to  and  after  the  proclamation  of  the  caliphate  (hence¬ 
forth  coined  “early  departees”  and  “late  departees,”  respectively). 
The  mean  age  of  the  late  departees  is  three  years  younger  than  the 
early  departees  (23.5  years  in  the  second-post  caliphate  year,  24.2 
years  in  the  first  post-caliphate  year  versus  26.6  years  with  the  early 
departees);  and  the  percentage  of  minors  (individuals  under  the  age 
of  18  years)  is  significantly  higher  (early  departees  5%,  first  post-ca- 
liphate  year  11%,  second  post-caliphate  year  16%).7 

It  should  be  noted  that  these  numbers  include  gender  specific 
differences:  female  departees  tend  to  be  significantly  younger  than 
their  male  counterparts  (median  age  23.5  versus  26.5  years);  ac¬ 
cordingly,  the  share  of  minors  among  the  female  departees  is  con¬ 
siderably  higher  (13%  versus  6%  among  the  males,  i.e.  nearly  four 
out  of  10  departed  minors  are  female).  Not  included  in  the  report 
on  German  foreign  fighters  compiled  by  the  German  agencies  are 
the  (substantial)  number  of  children  of  mostly  very  young  age  who 
were  taken  by  their  departing  parents.  The  fates  of  these  children, 
and  the  potential  threat  emanating  from  them,  after  growing  up  in 
a  violence-filled  and  highly  ideologically  charged  environment  such 
as  the  Islamic  State,  however,  produces  an  urgent  need  to  prepare 
for  their  reintegration  into  society.8 

Of  the  688  individuals  with  known  marital  status,  44%  were 
single,  28%  legally  married,  and  22%  were  married  under  Islamic 
law.  Two  hundred  and  ninety  departees  are  known  to  have  children. 
In  the  last  year,  however,  the  share  of  single  individuals  without 
children  and/or  their  own  household  rose  significantly.  The  reasons 
why  the  Islamic  State  seems  to  be  decreasingly  attractive  to  socially 
established  individuals  is  not  entirely  clear  from  the  collected  data. 
One  possibility  is  that  the  real-life  utopia  the  caliphate  presented  af¬ 
ter  its  proclamation  appealed  to  radicalized  families  as  well,  where¬ 
as  the  current  state  of  decline  lost  this  pull-factor. 

Close  to  90%  of  all  departees  lived  in  urban  areas,  with  just  13 
cities  being  the  place  of  residence  of  nearly  half  of  all  departees. 

Sixty-one  percent  of  the  departees  were  born  in  Germany,  with 
a  broad  range  of  other  places  of  birth  (38  countries).  The  most  sig¬ 
nificant  other  countries  are  Turkey  (6%),  Syria  (5%),  the  Russian 
Federation  (5%),  Morocco  (3%),  and  Lebanon  (3%).  Of  the  indi¬ 
viduals  born  abroad,  39%  immigrated  at  an  age  of  under  14  years, 
23%  as  teenagers  and  adolescents,'  and  38%  at  an  age  of  more  than 
21  years. 

Thirty-five  percent  of  all  departees  have  German  citizenship  ex¬ 
clusively  (with  significant  differences  with  regard  to  gender— 42% 
of  the  women  versus  33%  of  the  men).  Another  43%  hold  a  dual  cit¬ 
izenship  including  Germany,  while  22%  hold  foreign  citizenship."1 

Including  the  individuals  born  in  Germany,  a  total  of  81%  of 
all  departees  had  what  German  authorities  define  as  a  “migration 


c  German  law  differentiates  between  “youths"  (age  14-17)  and  “adolescents" 
(age  18-20). 

d  The  largest  groups  of  foreigners  have  citizenships  of  Turkey  (14%  of  the 
total  number)  and  Russia  (4%),  with  Syria,  Morocco,  and  Tunisia  the  next 
most  represented. 


background.”6 

The  data  available  on  the  schooling,  training,  and  occupation  of 
the  departees  is  broad.  Seventy-two  departees  are  known  to  have 
attended  a  school  at  the  actual  point  of  their  departure.  One-hun¬ 
dred  and  sixteen  individuals  are  known  to  have  begun  vocational 
training.  Of  these,  42%  had  completed  this  training  prior  to  their 
departure,  32%  had  dropped  out  of  it  before  they  left  Germany,  and 
26%  were  still  in  training  when  they  left  Germany.  Ninety-four  in¬ 
dividuals  are  known  to  have  begun  university  studies,  of  whom  10% 
had  completed  a  degree,  28%  had  discontinued  it,  and  63%  were 
still  enrolled  at  the  time  of  their  departure.  Another  111  individuals 
are  known  to  have  had  a  regular  job  at  that  point,  while  166  others 
were  unemployed. 

Religion/ldeology 

At  least  624  individuals  are  assessed  to  belong  to  the  core  salafi 
ideological  spectrum,  while  only  29  definitely  were  not  adherents 
to  this  religious  movement,  thus  rendering  this  specific  religious 
outlook  by  far  most  important  single  variable  in  describing  this  very 
heterogeneous  group.  German  domestic  intelligence  places  the  cur¬ 
rent  total  estimate  of  salafis  in  Germany  at  9,700,  with  a  persistent 
upward  trend/  This  very  dynamic  movement  provides  a  relatively 
large  recruitment  pool  from  which  to  draft  more  jihadis. 

At  least  134  departees  (17%  of  the  total  number)  are  converts. 
Converts  comprised  no  less  than  one-third  of  the  female  departees, 
in  several  cases  presumably  because  of  marriage  to  a  Muslim  man.g 

Criminal  Background 

Two-thirds  of  the  departees  have  been  the  subject  of  criminal  in¬ 
vestigations  (i.e.  suspected  of  or  tried  for  criminal  offenses)  with 
significant  differences  in  their  delinquent  behavior  before  and  after 
their  Islamist  radicalization.  Prior  to  Islamist  radicalization,  prop¬ 
erty  crime  and  violent  attacks  (assault,  robbery,  etc.)  were  the  most 
common  types  of  criminal  activity,  with  62%  of  those  with  crime 
links  involved  in  properly  crimes  and  60%  of  those  with  crime  links 
involved  in  violent  attacks.  The  next  most  common  type  of  crime 
was  drug  trafficking  (35%).  Politically  motivated  offenses  (i.e.,  crim¬ 
inal  acts  directed  against  political  or  ideological  opponents  or  con¬ 
stituting  unlawful  support  of  a  political  or  ideological  organization) 
made  up  only  a  small  percentage  of  crimes,  4%. 

After  the  beginning  of  the  radicalization  process,  the  prevalence 
of  crimes  that  individuals  engaged  in  shifted  dramatically,  with 
politically  motivated  offenses  (under  German  law)  perpetrated  by 
more  than  half  of  this  sub-group  (55%),  followed  by  violent  attacks 
(47%)  and  property  crime  (41%).  Drug-related  offenses  dropped  to 


e  In  Germany,  individuals  with  a  migration  background  are  officially  defined 
as  “all  persons  who  have  immigrated  since  1949  to  the  territory  that 
today  constitutes  the  Federal  Republic  of  Germany,  ail  foreigners  born  in 
Germany,  and  all  German  nationals  born  in  Germany  who  have  at  least 
one  parent  who  immigrated  to  Germany  or  who  was  born  as  a  foreigner 
in  Germany."  See  Bundesamt  fur  Statistik  (Federal  Statistical  Office)  for 
further  details. 

f  This  is  as  of  March  1,  2017,  per  the  Ministry  of  the  Interior,  Free  Hanseatic 
City  of  Bremen,  Germany. 

g  Two  years  ago,  Jessica  Stern  and  J.M.  Berger  highlighted  the 

disproportionately  high  number  of  converts  among  Western  foreign 
fighters,  confirming  a  historically  well-known  phenomenon.  Jessica  Stern 
and  J.M.  Berger,  ISIS:  The  State  of  Terror  (New  York:  HarperCollins,  2015),  p. 
81. 
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just  14%.  More  than  half  (53%)  of  the  individuals  with  a  criminal 
record  were  suspected  of  or  were  tried  for  three  or  more  offences, 
including  nearly  one-third  (32%)  who  had  been  charged  with  six 
or  more  crimes.  More  than  half  of  the  departees  were  suspects  in 
ongoing  criminal  investigations. 

These  findings  correlate  with  recent  studies  highlighting  the 
so-called  “crime-terror  nexus”9— in  other  words,  the  apparent¬ 
ly  growing  number  of  jihadis  who  originate  from  petty  criminal 
backgrounds.  As  Belgian  counterterrorism  official  Alain  Grignard 
has  noted,  many  foreign  fighters  in  this  generation  appear  to  be 
Islamized  radicals  rather  than  radicalized  Islamists.10 

Radicalization  Factors 

The  vast  majority  of  the  departees  were  radicalized  in  a  “real  life 
environment.”  The  most  relevant  factors  (with  multiple  aspects 
possible)  for  the  beginning  of  the  radicalization  were  like-mind¬ 
ed  friends  (54%),  contact  with  extremist  mosques  (48%),  internet 
contacts  (44%),  so-called  Islam  seminars  (27%),  organized  Qur’an 
distributions  (24%),  and  family  (21%),  with  contact  with  extremists 
in  school  or  prisons  accounting  for  only  a  very  few  cases.  During  the 
course  of  the  radicalization  process,  the  importance  of  close  social 
contacts  rose  even  higher,  with  the  most  serious  impact  coming 
from  like-minded  friends  (63%)  and  contacts  to  extremist  mosques 
(57%). 

In  the  majority  of  cases,  the  internet  (for  purposes  of  distributing 
propaganda  online)  played  only  a  supportive  and  reinforcing  role. 

In  many  cases,  the  radicalization  process  was  very  quick.  In 
cases  where  details  on  the  duration  of  radicalization  are  known  to 
the  security  authorities  (only  about  half  of  the  total),  nearly  half 
(46%)  of  the  departees  left  within  one  year  after  the  beginning  of 
the  radicalization  process,  with  close  to  a  quarter  (22%)  departing 
within  six  months  of  the  start  of  this  process.  Overall,  68%  of  the 
departees  left  within  two  years.  Again,  there  are  noteworthy  gender 
differences.  The  share  of  female  departees  among  individuals  who 
left  within  one  year  of  the  beginning  of  the  radicalization  process  is 
significantly  higher  (27%  versus  18%  for  male  departees). 

The  analysis  concludes  that  the  radicalization  process  of  very 
quickly  radicalized  individuals— especially  women — “still  takes 
place  largely,  though  not  always,  out  of  sight,  and  that  it  is  more 
often  a  self-referential  process,”11  (in  other  words,  a  radicalization 
process  not  predominantly  fueled  by  social  contacts,  but  by  inward 
musings). 

Radicalization  took  place  even  more  quickly  after  the  procla¬ 
mation  of  the  caliphate.  The  median  duration  of  the  radicalization 
of  the  departees  dropped  from  27  to  20  months.  Correspondingly, 
the  share  of  departees  who  left  Germany  within  one  year  after  the 
beginning  of  their  radicalization  climbed  from  42%  to  60%  in  the 
post-caliphate  declaration  phase.  In  this  context,  the  seemingly  re¬ 
al-life  implementation  of  the  Islamist  utopia  seems  to  have  worked 
as  an  accelerator  for  the  radicalization  process,  as  it  appeared  to 
fulfill  the  Islamist  ideals,  thus  strengthening  and  reinforcing  the 
desire  to  actively  take  part  in  this  endeavor. 

Although  individual  radicalization  normally  gets  noticed  by 
family,  friends,  or  acquaintances  at  some  point,  a  surprisingly  high 
number  of  persons  departed  before  their  Islamist  radicalization  was 
recognized  by  others,  according  to  the  German  official  data.  Natu¬ 
rally,  however,  the  recognition  of  an  ongoing  radicalization  would 


“Although  individual  radicalization 
normally  gets  noticed  by  family, 
friends,  or  acquaintances  at  some 
point,  a  surprisingly  high  number  of 
persons  departed  before  their  Islamist 
radicalization  was  recognized  by 
others.” 


depend  on  the  duration  of  the  individual  radicalization  process.*1 

The  Threat  from  Returning  Fighters 

The  threat  posed  by  the  departed  Islamists  from  Germany  should 
be  evaluated  within  the  overall  jihadi  context.  The  military  setbacks 
the  Islamic  State  have  experienced  over  the  last  year  and  a  half- 
including  the  loss  of  relatively  secure  access  routes— coupled  with 
the  unprecedented  surge  in  refugees  from  Syria  and  other  Middle 
East  and  North  African  countries  to  Europe  have  contributed  to  a 
significant  change  of  the  threat  landscape.  The  Islamic  State  quickly 
adapted  and  called  upon  its  adherents  in  Western  countries  not 
to  try  to  travel  to  the  so-called  caliphate,  but  to  commit  terrorist 
attacks— be  they  suicide  attacks  or  hit-and-run  attacks— in  their 
countries  of  residence.12  Germany  has  seen  Islamic  State  sympathiz¬ 
ers  respond  to  this  call  by  carrying  out  attacks  involving  easily  avail¬ 
able  weapons  such  as  knives;  axes;  home-made,  crude  improvised 
explosive  devices;  and  in  the  case  of  the  Berlin  attack,  a  truck.13 

As  the  official  report  correctly  points  out,  the  initial  success  of 
the  Islamic  State,  and  especially  the  proclamation  of  the  caliphate, 
mobilized  and  radicalized  significant  parts  of  the  German  salafi 
community  in  an  unprecedented  way.  The  ongoing  conflict  in  Syr¬ 
ia — and  to  a  lesser  extent  Iraq— has  been  used  by  salafi  jihadis  to 
propagate  their  extremist  ideology,  focusing  on  the  simple  dichot¬ 
omic  message  of  a  constant  worldwide,  defensive  fight  between  the 
iimmah  (the  community  of  the  Islamic  peoples)  and  the  infidels.14 

While  the  caliphate  may  have  lost  its  “pull  potential”  since  early 

2015,  there  is  no  evidence,  despite  the  much  slower  rate  of  depar¬ 
tures,  that  the  jihadi  ideology  symbolized  by  the  Islamic  State  has 
weakened  in  strength  in  Germany  and  much  of  Western  Europe. 
German  domestic  intelligence  reports  still  rising  numbers  of  vio¬ 
lence-promoting  Islamists  in  Germany.  While  1,000  of  the  German 
salafis  were  considered  violent  just  half  a  year  ago,15  the  Federal  Of¬ 
fice  for  the  Protection  of  the  Constitution  (BfV)  chief  Hans-Georg 
Maafien  put  that  number  at  1,600  at  a  conference  in  late  February 

2016.  The  federal  criminal  police  office  BKA  rates  approximately 
570  individuals— not  all  of  them  currently  residing  in  Germany, 
however— as  “Gefahrder,”  meaning  capable  of  plotting  a  terrorist 
attack.16 

In  this  context,  the  returning  Islamists  pose  a  serious  threat  to 


h  The  analysis  provides  detailed  information  on  the  outward  signs  of  the 
individual  radicalization  that  is  not  relevant  to  this  article.  See  Daniel  H. 
Heinke,  "Foreign  Terrorist  Fighters:  German  Islamists  in  Syria  and  Iraq  and 
What  Can  be  Done  About  Them,"  Marshall  Center  Security  Insights  No.  15 
(2016). 
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“The  data  shows  that  there  are  no 
simple  patterns  of  radicalization  or 
recruitment  of  jihadi  fighters.  Hence, 
countermeasures  need  to  be  both 
multifaceted  and  specific.” 


the  national  security  of  Germany  and  Western  Europe  in  general. 
As  of  late  2016,  approximately  15,000  foreign  terrorist  fighters  are 
thought  to  be  in  Syria  and  Iraq,17  among  them  a  large  number  of 
the  5,000-6,000  who  traveled  from  Europe,18  and  many  of  them 
will  try  to  return  to  their  countries  of  origin,  especially  if  they  came 
from  Western  Europe.  Already  30%  of  the  individuals  who  depart¬ 
ed  from  the  European  Union  are  known  or  assessed  to  have  re¬ 
turned,19  mirroring  the  rate  of  returnees  to  Germany  described  in 
the  introduction  of  this  article.  Given  limited  resources,  the  sheer 
numbers  carry  the  threat  of  overwhelming  the  agencies  tasked  with 
counterterrorism  on  domestic  soil.20 

Radicalized  to  a  jihadi  worldview,  and  in  many  cases  having  ex¬ 
perienced  armed  combat  with  the  Islamic  State  or  at  least  under¬ 
gone  some  sort  of  (para-)  military  training,  the  returning  foreign 
fighters  are  adding  lethal  capabilities  to  an  already  highly  adrenal- 
ized  Islamist  community.21  An  especially  dangerous  threat  would 
include  the  linking  up  of  returning  fighters  with  individuals  in  their 
communities  who  were  barred  from  departure  to  Syria  through  ad¬ 
ministrative  measures. 

Returning  foreign  fighters  still  committed  to  the  cause  may 
choose  to  continue  their  jihadi  activities  on  their  own  or  to  act  un¬ 
der  the  direction  of  the  dedicated  Islamic  State  operations  branch. 
Training  and  battlefield  experience  are  elements  that  most  extrem¬ 
ists  in  Germany  lacked  previously.  This  reality  establishes  a  chal¬ 
lenge  to  be  faced  not  only  within  the  next  couple  of  years,  but  most 
probably  for  an  entire  generation.22 

Another  concern  is  that  given  high  rates  of  past  criminality 
among  German  foreign  fighters,  many  of  the  returnees  will  be  part 
of  friendship  groups  with  strong  ties  to  criminal  activities.  They 
may  reestablish  these  links  to  support  terrorist  attacks  on  German 
soil— either  through  crimes  as  a  means  of  financing  or  through  the 
procurement  of  weapons. 

Furthermore,  in  many  cases,  returning  fighters  will  have  de¬ 
veloped  personal  bonds  with  others  abroad,  often  within  certain 
ethnic  groups  (for  example,  European  foreign  fighters  of  Chechen 
descent)  that  transcend  national  borders.  Just  as  in  the  Afghan  ji¬ 
had,  the  Syrian  jihad  has  created  a  generation  of  foreign  fighters 
with  international  Rolodexes.  One  example  were  the  foreign  fight¬ 
ers  from  Germany  and  Austria  who  joined  the  Chechen  Junud  al 
Sham  fighting  brigade  in  Syria.  As  Guido  Steinberg  has  noted,  “The 
shared  experiences  of  that  group  created  tight  bonds  between  Ger¬ 
mans,  Turks,  Caucasians,  and  jihadis  of  other  nationalities  which 
will  likely  shape  the  nature  of  the  terrorist  threat  in  Germany.”23 
These  bonds  may  create  networks  that  are  exceptionally  hard  for 


security  authorities  to  infiltrate.1 

Using  the  Data  to  Combat  Terrorism 

The  official  data  compiled  on  German  foreign  fighters  and  their 
radicalization  trajectories  is  useful  in  countering  future  departures 
of  foreign  terrorist  fighters  and  developing  a  strategy  on  how  to 
deal  with  the  returnees.  As  the  largest  such  study  conducted  by 
any  Western  government,  it  is  also  useful  to  policymakers  in  other 
countries  facing  the  same  threat. 

The  key  findings  of  the  German  security  services’  study  were  as 
follows: 

1.  Race,  country  of  origin,  gender,  age,  relationship  status,  edu¬ 
cational  background,  or  prior  criminal  involvement  of  the  departees 
are  so  diverse  that  no  universally  accepted  common  denominator 
could  be  deduced. 

2.  Radicalization  predominantly  takes  place  in  a  “real  life”  en¬ 
vironment.1 

3.  As  foreign  departures  slow  from  Germany,  the  pull  effect  of 
the  so-called  caliphate  is  further  diminishing  to  a  nearly  non-exis¬ 
tent  level. 

4.  The  number  of  individuals  trying  to  return  to  Germany  is  in¬ 
creasing. 

5.  Nearly  all  departees  belong  to  the  salafi  religious/ideological 
stream. 

6.  Around  80%  of  the  departees  have  a  so-called  “migration 
background.” 

7-  Certain  gender-specific  radicalization  aspects  call  for  gen¬ 
der-specific  prevention  activities;  women  tend  to  undergo  a  quicker 
radicalization  process  and  within  the  private  sphere. 

The  data  shows  that  there  are  no  simple  patterns  of  radicaliza¬ 
tion  or  recruitment  of  jihadi  fighters.  Hence,  countermeasures  need 
to  be  both  multifaceted  and  specific.  While  a  full  discussion  of  the 
types  of  approaches  that  maybe  warranted  are  beyond  the  scope  of 
this  article,  a  number  of  observations  can  be  made.k 

The  first  is  that  the  scale  of  the  foreign  fighter  problem  means 
that  criminal  investigations  alone  will  not  suffice  in  tackling  it.  Due 
to  the  challenges  the  prosecution  faces  in  these  cases  (including  the 
availability  and  collection  of  evidence  and  the  conversion  of  intelli¬ 
gence  into  admissible  forensic  evidence24),  the  verdicts  so  far  tend 
to  impose  sentences  of  three  to  four  years  for  the  active  support  of 
the  Islamic  State  rather  than  on  more  concrete  charges  of  murder.25 
This  means  that  the  threat  emanating  from  these  individuals  in 


i  Another  threat  to  public  security  are  returning  fighters  who  turn  their  back 
on  jihadism  but  choose  to  employ  skills  obtained  in  jihadi  battle-zones 
within  organized  crime  groups.  Martin  Gallagher,  “‘Criminalised’  Islamic 
State  Veterans  -  A  Future  Major  Threat  in  Organised  Crime  Development?" 
Perspectives  on  Terrorism  10:5  (2016):  pp.  51-67. 

j  Editor's  note:  Georg  Heil  illustrated  the  various  aspects  of  such  a  “real 
life  environment”  with  the  example  of  the  German  Abu  Walaa  network. 

See  Georg  Heil,  "The  Berlin  Attack  and  the  Abu  Walaa  Islamic  State 
Recruitment  Network,"  CTC  Sentinel  10:2  (2017).  Jan  Raudszus  presented 
another  interesting  case  study  in  “Der  Tag  des  Verfuhrers,"  DieZeit, 
September  29,  2016. 

k  It  should  also  be  pointed  out  that  administrative  measures  aimed  at 
preventing  individuals  from  departing  to  Syria,  such  as  the  requirement 
to  report  to  police  stations  at  certain  intervals  and  the  withdrawal  of 
passports  and  other  identity  documents,  will  not  be  very  effective  in 
combating  the  threat  from  foreign  fighters  who  have  already  returned  to 
Germany. 
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many  cases  will  be  only  delayed  for  a  relatively  short  period  of  time. 
It  also  means  there  is  a  strong  argument  for  collaboration  between 
foreign  intelligence  services  (both  national  and  allied  ones)  and  law 
enforcement  agencies  to  be  intensified  to  try  to  provide  evidence 
for  more  serious  offenses  committed  when  these  individuals  were 
serving  the  Islamic  State. 

A  second  observation  is  the  criminal  background  of  many  dep- 
artees  provides  law  enforcement  with  opportunities  to  aggressively 
pursue  criminal  investigations  into  activities  of  foreign  fighters  not 
directly  related  to  terrorist  activities,  thus  providing  a  different  an¬ 
gle  for  law  enforcement  operations. 

Thirdly,  the  significant  role  played  by  contact  with  extremist 
mosques  and  study  circles  in  the  radicalization  of  German  foreign 
fighters  should  inform  the  debate  over  whether  more  concerted  ef¬ 
forts  to  proscribe  organizations  considered  a  threat  to  public  secu¬ 
rity,  including  closing  down  affiliated  gathering  places  (like  clubs  or 
even  mosques  whose  activity  breaks  German  law),  are  warranted.1 1 2 3 4 5 6 
While  not  eliminating  the  extremist  views  of  the  main  actors,  such 
measures  can  counter  the  establishment  and  operation  of  radical¬ 
ization  hubs. 

Fourthly,  given  the  increasingly  fast  pace  of  radicalization, 
attempts  to  counter  radicalization  efforts  directed  against  possi¬ 
ble  new  recruits  in  the  early  stages  of  radicalization  may  also  be 
warranted,  as  well  as  initiatives  developed  to  deradicalize  or  dis¬ 
engage  known  extremists,  including  returned  foreign  fighters.26 


I  Editor's  note:  Georg  Heil  described  how  a  mosque  in  Heidelberg  and  a 
“madrassa”  in  Dortmund  were  allegedly  used  to  indoctrinate  individuals 
by  the  extremist  network  Abu  Walaa.  See  Georg  Heil,  “The  Berlin  Attack 
and  the  Abu  Walaa  Islamic  State  Recruitment  Network,"  CTC  Sentinel  10:2 
(2017). 


Although  several  states  and  cities  have  already  developed  preven¬ 
tion  programs  and  agreed  to  a  coordinated  set  of  preventative  and 
intervention  measures  directed  against  Islamist  violent  extrem¬ 
ism,  Germany  still  lacks  a  national  strategy”1  against  violent  ex¬ 
tremism,  let  alone  a  coherent  national  counterterrorism  strategy. 
The  findings  outlined  in  this  article  indicate  this  strategy  would 
be  well  advised  to  deal  not  only  with  criminal  offenses  but  with  a 
sort  of  social — though  unlawful— movement.  They  also  indicate  a 
tailored  and  specialized  CVE  approach  would  be  helpful,  orientat¬ 
ed  to  specific  sub-groups,  whether  women,  people  with  migration 
background,  or  other  identifiable  clusters. 

The  foreign  fighter  phenomenon  already  has  a  societal  impact 
reaching  far  beyond  the  scope  of  law  enforcement  and  public  secu¬ 
rity.  This  ‘fallout’  may  include  polarization  between  political,  eth¬ 
nic,  or  religious  groups  or  a  rising  anxiety  within  the  population 
leading  to  a  “securization  of  society,”27  requiring  countermeasures 
on  a  political  level  within  a  comprehensive  strategic  approach.  In 
the  meantime,  the  terrorist  threat  in  Germany,  as  in  many  other 
Western  European  countries,  remains  at  an  all-time  high.  Law  en¬ 
forcement  agencies  as  well  as  domestic  intelligence  agencies  at  both 
the  federal  and  state  level  will  have  to  remain  vigilant,  and  return¬ 
ing  foreign  fighters  will  be  among  the  top  of  their  list  of  persons  of 
interest.  CTC 


m  The  Bremen  state  Minister  of  the  Interior  proposed  such  a  strategy, 
arguing  it  was  imperative  to  provide  for  the  necessary  vertical  (federal 
government,  states,  municipalities)  as  well  as  horizontal  (departments 
of  the  interior,  justice,  education,  social  affairs,  etc.)  coordination  of  all 
relevant  actors.  See  Daniel  Heinke,  “Warum  Deutschland  eine  Nationale 
Praventionsstrategie  gegen  gewaltbereiten  Extremismus  braucht," 
Sicherheitspolitik-Blog,  June  1,  2015. 
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The  jihadi  threat  within  Australia  has  transformed. 
Terror  plots  have  become  more  frequent,  with  up  to  16 
occurring  since  September  2014,  but  have  also  become 
less  ambitious.  Australian  jihadism  has  evolved  since 
the  1990s,  following  international  developments,  most 
recently  the  Syrian  civil  war  and  the  rise  of  Islamic 
State.  The  threat  has  also  been  shaped  by  aspects  of 
Australia’s  counterterrorism  response,  particularly  the 
use  of  travel  restrictions  to  prevent  suspected  jihadis 
from  joining  groups  abroad.  These  measures  appear  to 
have  contributed  to  the  increased  number  of  plots,  but 
also  helped  to  keep  the  plots  relatively  unsophisticated. 

On  December  23,  2016,  Australian  counterterrorism 
authorities  raided  houses  across  Melbourne  to  dis¬ 
rupt  a  suspected  terror  plot  inspired  by  the  Islamic 
State.  Four  men  were  charged  for  allegedly  planning 
to  detonate  improvised  explosive  devices  (IEDs)  in 
the  center  of  Melbourne  on  Christmas  Day,  targeting  such  popular 
locations  as  Federation  Square  and  St.  Paul’s  Cathedral.1 

This  plot  was  just  the  most  recent  manifestation  of  what  had 
become  a  continuous  threat  for  Australia.  Four  violent  jihadi  at¬ 
tacks  had  occurred  since  September  2014,  resulting  in  the  deaths  of 
one  police  employee,  two  civilians,  and  three  perpetrators.  Security 
agencies  had  foiled  up  to  12  jihadi  plots  during  the  same  16-month 
period.  Whereas  jihadi  plots  were  once  rare  in  Australia,  today  the 
threat  has  undergone  a  dramatic  change.  This  article  explains  the 
threat  transformation.  It  outlines  the  16  alleged  or  proven  plots 
since  late  2014,  shows  how  Australian  jihadism  has  evolved  since 
the  1990s  to  reach  its  current  level,  and  explains  how  the  plots  be¬ 
came  more  frequent,  though  less  sophisticated. 

The  Current  Threat:  Its  Scale  and  Form 

After  September  2014,  when  the  Islamic  State  escalated  its  efforts 
to  launch  attacks  abroad,  Australia  faced  an  unprecedented  series 
of  terror  attempts.  This  began  shortly  before  the  now-deceased  Is¬ 
lamic  State  spokesman  Mohammad  al-Adnani’s  worldwide  call  to 
arms  on  September  22  of  that  year.2  On  September  12,  the  Nation¬ 
al  Terrorism  Alert  Level  was  raised  from  medium  to  high  for  the 
first  time  in  its  history.3  This  move  was  made  on  the  advice  of  the 
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Australian  Security  Intelligence  Organisation  (ASIO),  which  had 
long  been  concerned  that  the  foreign  fighter  flow  to  Syria  would 
be  a  “game  changer.”4  Less  than  a  week  later,  security  agencies  in¬ 
tercepted  a  message  from  a  Syria-based  Australian  Islamic  State 
member  allegedly  instructing  his  supporters  at  home  to  murder  a 
random  member  of  the  public.5  On  September  19,  2014,  the  agen¬ 
cies  responded  by  launching  Australia’s  largest  ever  counterterror¬ 
ism  raids.  More  than  800  federal  and  state  police  officers  in  Joint 
Counter-Terrorism  Teams  (J  CTTs)1'  raided  houses  across  Sydney 
and  Brisbane  to  suppress  the  threat  and  disrupt  suspected  support 
networks.6 

Counterterrorism  operations  soon  became  routine,  with  raids 
occurring  roughly  every  month.  By  the  end  of  2016,  up  to  12  alleged 
jihadi  plots  had  been  disrupted  by  counterterrorism  action  while 
four  violent  attacks  had  occurred.  These  incidents  are  summarized 
in  the  appendix.6 

These  plots  share  several  characteristics.  First,  the  role  of  the 
Islamic  State  itself  was  often  limited.  Some  of  the  plots  involved  vir¬ 
tual  planning  (where  overseas  Islamic  State  members  communicat¬ 
ed  directly  with  the  plotters  in  Australia  to  instruct  and  encourage 
them),7  while  most  appear  to  have  been  launched  by  unconnected 
individuals  merely  inspired  by  the  Islamic  State.  Similarly,  none  of 
the  Australian  plots  involved  returned  fighters  from  Syria  or  Iraq, 
nor  were  they  centrally  planned  by  the  Islamic  State  in  a  way  com¬ 
parable  to  attacks  in  Brussels  and  Paris.8  This  contrasts  with  the 
situation  in  Europe.  According  to  a  2016  dataset  created  by  scholars 
Petter  Nesser,  Anne  Stenersen,  and  Emilie  Oftedal,  there  were  38 
Islamic  State-associated  terror  plots  in  Europe  between  January 
2014  and  October  2016.  In  only  six  of  these  was  the  Islamic  State’s 
role  limited  to  just  inspiration.11 

Another  characteristic  of  the  Australian  plots  is  that  most  of 
them  were  small-scale  and  unsophisticated,  being  carried  out  by  in¬ 
dividual  attackers  or  very  small  cells.  They  tended  to  involve  blades 
or  sometimes  firearms  (mainly  handguns  or  shotguns)  rather  than 
attempts  to  make  explosives.  In  most  cases,  the  plotters  did  not 
appear  to  seek  mass  casualties  but  aimed  to  kill  one  or  more  people 
in  a  highly  public  manner.  The  most  common  targets  were  police 
officers. 


a  Joint  Counter-Terrorism  Teams  (JCTTs)  were  created  after  9/11  to  bridge 
federal-state  divisions  in  counterterrorism.  JCTTs  operate  in  each  state 
and  include  ASIO  officers,  federal  police  officers,  state  police  officers, 
and  members  of  any  other  relevant  agencies  (such  as  the  NSW  Crime 
Commission). 

b  The  appendix  is  based  on  a  database  maintained  by  the  author. 

c  The  authors  found  there  were  12  plots  in  Europe  during  this  period  linked  to 
the  Islamic  State’s  external  operations  wing  and  another  19  plots  involved 
“online  instruction  from  members  of  IS’s  networks."  Petter  Nesser,  Anne 
Stenersen,  and  Emilie  Oftedal,  "Jihadi  Terrorism  in  Europe:  The  IS-Effect," 
Perspectives  on  Terrorism  10:6  (2016):  pp.  4,  8. 
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This  is  not  unique  to  Australia;  such  attacks  have  been  seen 
across  the  West  in  recent  years.  What  is  distinctive  is  that  Australia’s 
current  threat  has  consisted  almost  entirely  of  these  types  of  rela¬ 
tively  unsophisticated  plots.  This  reality  makes  the  threat  Austra¬ 
lia  faces  different  than  Europe,  which  experienced  several  Islamic 
State  plots  involving  explosives  like  triacetone  triperoxide  (TATP) 
and  automatic  firearms.9  The  main  exception  was  the  suspected 
Christmas  Day  2016  plot  in  Melbourne,  where  the  attackers  were 
unusually  ambitious  and  allegedly  attempting  to  make  IEDs  and 
target  popular  venues. 

The  current  threat  also  differs  from  Australia’s  past  jihadi  activ¬ 
ity.  The  four  main  jihadi  plots  Australia  experienced  before  2014 
(occurring  in  2000,  2003,  2005,  and  2009)  were  more  ambitious. 
These  pre-2014  plots  sought  to  cause  mass  casualties,  often  by  using 
explosives  and  usually  involving  returned  foreign  fighters. 

Understanding  this  transformation  requires  understanding  of 
how  jihadism  within  Australia  has  evolved  over  the  past  20  years 
and  how  the  counterterrorism  response  has  shaped  the  threat. 

How  the  Threat  Grew 

Prior  to  9 / 11,  Australia  was  not  significantly  affected  by  the  political 
events  behind  modern  jihadism,  such  as  the  Soviet  invasion  of  Af¬ 
ghanistan  and  the  rise  and  fall  of  Islamist  movements  in  the  Middle 
East  and  North  Africa.  In  contrast,  Europe  became  an  inadvertent 
haven  from  the  1980s  onward  as  members  of  mainly  Egyptian  and 
Algerian  jihadi  groups  fled  state  crackdowns.  Support  networks 
also  formed  in  Europe  to  mobilize  foreign  fighters,  first  to  the  an¬ 
ti-Soviet  war  in  Afghanistan  and  then  to  Bosnia  and  Chechnya, 
helping  to  create  the  groundwork  for  future  attacks.10 

The  Australian  situation  was  different,  however,  with  few  jihadi 
support  networks  present  before  9 /ll.  The  main  exception  was  that 
the  Indonesian  jihadi  group  Jemaah  Islamiyah  established  a  small 
Australian  branch  focused  on  fundraising,  with  an  estimated  30 
members  across  Perth,  Sydney,  and  Melbourne.11  There  were  also 
informal  pro-jihadi  networks  mainly  located  in  Sydney  and  cen¬ 
tered  on  a  few  key  figures,  such  as  Belal  Khazaal.  Before  arriving  in 
Australia  from  Lebanon  in  1987,  Khazaal  had  reportedly  been  part 
of  a  Sunni  jihadi  milieu  based  around  Palestinian  camps  in  Sidon, 
which  included  followers  of  Abdullah  Azzam.12  In  the  1990s,  he 
was  a  leader  in  the  Islamic  Youth  Movement  (whose  membership 
has  been  estimated  at  fewer  than  50),  which  produced  an  extremist 
magazine  called  Nida’ul  Islam  that  ran  interviews  with  Usama  bin 
Ladin,  Abu  Muhammad  al-Maqdisi,  Abu  Qatada,  and  the  leaders  of 
Jemaah  Islamiyah  and  several  other  jihadi  groups.13  He  would  later 
be  convicted  in  absentia  by  Lebanese  courts  for  terrorism  offenses 
and  also  convicted  in  Australia  for  compiling  a  terrorist  manual.14  d 
The  networks  surrounding  Khazaal  interacted  closely  with  Jemaah 
Islamiyah’s  Australian  branch  at  times,  and  some  members  of  these 
networks  trained  in  Afghanistan  with  al-Qa'ida  and  in  Pakistan 
with  Lashkar-e-Taiba  (LeT).  Yet  on  the  whole,  Australia  was  mostly 
unaffected  by,  and  somewhat  oblivious  to,  the  global  jihadi  threat. 

This  did  not  last.  After  the  9/11  attacks,  three  factors  escalated 


d  Khazaal  has  also  been  accused  of  other  activities,  but  these  have  not  been 
tested  in  any  court.  For  example,  a  Central  Intelligence  Agency  report 
described  Khazaal  as  having  trained  with  al-Qa'ida  in  Afghanistan  in 
1998  and  acting  as  its  representative  in  Australia.  Sally  Neighbour,  “The 
Australian  Connections,"  Australian  Broadcasting  Corporation,  2003. 


the  threat  within  Australia.  The  first  factor  was  opportunity.  The 
rise  of  al-Qa'ida  affiliates  and  emergence  of  new  jihadi  theaters 
across  the  world  provided  new  avenues  for  people  to  join  the  move¬ 
ment.15  Aspiring  Australian  jihadis  took  advantage  of  this  reality 
over  the  next  decade.  Some  continued  to  train  in  Pakistan,  but  this 
largely  ended  around  2003.  Several  Australians  became  involved 
with  Lebanese  jihadi  groups  such  as  Asbat  al-Ansar  and  Fatah  al-Is- 
lam,  while  some  joined  jihadi  groups  in  Somalia  and  Yemen.16 

The  second  factor  was  that  Australia’s  strategic  significance  in¬ 
creased.  Before  9/11,  Australia  had  less  strategic  importance  for  the 
global  jihadi  movement  and  only  experienced  one  known  jihadi 
plot.  This  was  al-Qa '  ida’s  unsuccessful  attempt  to  co-opt  members 
of  Jemaah  Islamiyah’s  Australian  branch  to  attack  the  Israeli  Em¬ 
bassy  in  Canberra,  the  Consulate  in  Sydney,  and  a  prominent  Jew¬ 
ish  businessman  in  Melbourne.17  The  targets  and  timing  (during 
the  build-up  to  the  2000  Sydney  Olympics,  which  would  guarantee 
global  publicity)  suggests  that  Australia  was  seen  as  a  potential  are¬ 
na  for  violence  rather  than  a  valuable  target. 

After  9/11,  this  changed.  As  Australia  joined  the  wars  in  Afghan¬ 
istan  and  Iraq  and  provided  extensive  counterterrorism  assistance 
to  Southeast  Asian  countries  following  the  2002  Bali  bombings,  it 
was  repeatedly  named  in  al-Qa'ida  propaganda.18  It  became  clear 
to  aspiring  jihadis  within  Australia  that  the  country  was  deemed  a 
legitimate  target.  Moreover,  global  jihadi  propaganda  evolved  to 
designate  the  West  as  a  generic  enemy  (sometimes  citing  issues  oth¬ 
er  than  foreign  policy,  such  as  cartoons  of  the  Prophet  Muhammad) 
regardless  of  a  particular  Western  country’s  relationship  with  the 
United  States.19 

The  designation  of  Australia  as  a  target  was  not  limited  to  threat¬ 
ening  statements.  In  late  2002,  Melbourne  man  Joseph  Thomas 
was  offered  money  by  senior  al-Qa '  ida  figure  Khalid  bin  Attash  to 
identify  military  installations  to  target  in  Australia.20  This  did  not 
result  in  a  plot,  but  it  demonstrated  al-Qa '  ida’s  active  interest  in 
attacking  Australia,  which  was  shared  by  other  jihadi  groups.  In 
2003,  security  agencies  uncovered  a  plot  involving  Sydney  resident 
Faheem  Lodhi,  who  had  trained  with  LeT.21  He  had  coordinated 
with  French  LeT  trainee  Willie  Brigitte  and  senior  LeT  figure  Sa- 
jid  Mir,  who  would  become  one  of  the  masterminds  of  the  2008 
Mumbai  massacre.22  In  September  2004,  the  Australian  Embassy 
in  Indonesia  was  bombed  by  an  al-Qa  ida- aligned  splinter  of  Je¬ 
maah  Islamiyah.23 

The  third  factor  was  that  radicalization  increased  within  Austra¬ 
lia,  boosting  the  potential  number  of  willing  participants.  This  was 
partly  prompted  by  some  foreign  fighters,  who  had  left  Australia 
in  the  late  1990s  and  early  2000s,  returning  from  Afghanistan  and 
Pakistan.  It  was  also  spurred  by  al-Qa' ida’s  message  being  broad¬ 
casted  globally  through  online  and  other  means.  At  the  same  time, 
the  “War  on  Terror”  became  part  of  Australia’s  domestic  political 
atmosphere,  subjecting  Muslims  to  a  degree  of  political  and  media 
hostility,  potentially  reinforcing  al-Qa 'ida’s  narrative  of  a  Western 
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Armed  police  during  the  hostage  siege  at  a  cafe  in  Sydney,  Australia,  on  December  15, 2014  (Saeed  Khan/AFP/Getty  Images) 


war  against  Islam.6  Some  Australians  who  had  not  been  involved  in 
jihadism  before  9/11  now  became  involved,  manifesting  in  a  series 
of  self-starting  terror  plots. 

One  such  plot,  foiled  by  Operation  Pendennis  in  2005,  involved 
two  terrorist  cells  in  Melbourne  and  Sydney  who  had  amassed 
bomb-making  equipment.24  The  plotters  pointed  to  Australia’s  role 
in  Afghanistan  and  Iraq  and  were  inspired  by  the  global  spread  of 
jihadism,  with  their  leader  citing  “the  bombings  in  New  York  and 
Washington,  Bali,  Madrid,  Jakarta,  London  and  Iraq,  as  exemplars 
to  be  admired  and  emulated.”25  Some  of  the  terrorists  were  returned 
foreign  fighters  (one  member  of  the  Melbourne  cell  had  trained 
with  al-Qa'ida,  and  some  members  of  the  Sydney  cell  trained  with 
LeT),  but  several  were  recently  radicalized.26 

These  three  factors  (increased  opportunity  through  the  spread 
of  jihadi  theaters,  Australia’s  increased  strategic  importance,  and 
the  rise  of  local  radicalization)  contributed  to  a  small  but  persistent 
level  of  jihadi  activity  within  Australia  for  the  first  decade  after  9/11. 


e  According  to  the  most  recent  census  in  2011,  Australia's  Muslim  population 
was  around  476,000.  About  40  percent  were  born  in  Australia,  with  the 
next  most  common  countries  of  birth  being  (in  descending  order)  Lebanon, 
Pakistan,  Afghanistan,  Turkey,  Bangladesh,  Iraq,  Iran,  Indonesia,  India, 
and  Saudi  Arabia.  The  majority  are  Sunni.  See  Riaz  Hassan,  "Australian 
Muslims:  a  Demographic,  Social  and  Economic  Profile  of  Muslims 
in  Australia  2015,"  International  Centre  for  Muslim  and  non-Muslim 
Understanding,  University  of  South  Australia,  2015.  On  the  post-9/11 
experiences  of  Muslim  Australians,  see  Raimond  Gaita,  ed.,  Essays  on 
Muslims  and  Multiculturalism  (Melbourne:  Text  Publishing,  2011). 


Then,  the  Syrian  civil  war  and  rise  of  the  Islamic  State  escalated 
the  threat  further.  The  Islamic  State’s  initial  battlefield  successes, 
its  global  propaganda,  online  mobilization,  and  until  recently,  the 
relative  ease  of  traveling  through  Turkey,  made  it  more  difficult  for 
distant  countries  to  remain  unaffected.27 

This  created  a  foreign  fighter  flow  larger  than  any  earlier  trans¬ 
national  jihadi  mobilization,  which  Australia  became  swept  up  in. 
According  to  the  most  recent  public  ASIO  estimates/  there  are 
currently  100  Australians  in  Syria  and  Iraq  involved  with  jihadi 
groups  (mainly  the  Islamic  State).  In  addition,  somewhere  between 
64  and  70  Australian  members  of  these  groups  have  been  killed  in 
the  conflict.  Around  190  people  still  within  Australia  are  suspected 
of  providing  various  forms  of  support,  such  as  funding,  facilitating 
the  flow  of  fighters,  and  allegedly  an  attempt  to  assist  the  Islamic 
State  with  missile  technology.28 

The  mobilization  drew  on  earlier  jihadi  networks.  For  example, 
Khaled  Sharrouf,  who  had  served  prison  time  for  being  part  of  the 
Sydney  cell  in  the  2005  plot  foiled  by  Operation  Pendennis,  man¬ 
aged  to  leave  Australia  and  join  the  Islamic  State.29  He  was  joined 
by  Mohamed  Elomar,  who  had  had  one  uncle  (Mohammed  Ali  Elo- 
mar)  convicted  for  his  role  in  the  Pendennis  plot,  and  another  un¬ 
cle  (Hussein  Elomar)  convicted  of  terrorism  offenses  in  Lebanon.30 


f  These  figures  come  from  ASIO  Director-General  Duncan  Lewis  testifying  at 
the  Senate  Legal  and  Constitutional  Affairs  Committee  Estimates  hearing 
on  October  18,  2016,  and  February  28, 2017.  Transcripts  of  the  hearings  are 
available  at  parlinfo.aph.gov.au. 
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Ezzit  Raad,  convicted  for  his  role  in  the  Melbourne  cell  in  the  same 
plot,  also  joined  the  Islamic  State  and  was  eulogized  in  the  Islamic 
State’s  online  magazine  Rumiyah  after  he  died  in  combat.31  How¬ 
ever,  many  other  Australians  involved  had  no  role  in  these  earlier 
networks.  Some  individuals  made  their  own  journey  to  the  conflict 
zone,  while  newjihadi  networks  formed  in  Melbourne,  Sydney,  and 
Brisbane  and  reached  out  to  the  Islamic  State. 

A  significant  proportion  of  the  Australian  fighters  are  report¬ 
edly  of  Lebanese  heritage,  as  the  mobilization  built  on  a  history 
of  jihadi  connections  between  Australia  and  Lebanon,  along  with 
outrage  against  the  Assad  regime’s  atrocities  against  Sunni  Mus¬ 
lims  in  the  Levant.32  But  many  participants,  particularly  members 
of  these  newer  networks,  had  no  familial  connection  to  the  region 
and  came  from  a  range  of  ethnicities,  including  Afghan,  Turkish, 
Somali,  and  Anglo  backgrounds,  consistent  with  the  Islamic  State’s 
global  appeal.33 

This  unprecedented  mobilization  heightened  the  threat  within 
Australia.  As  part  of  the  international  coalition  against  the  Islamic 
State,  Australia  continued  to  hold  strategic  importance.  Austra¬ 
lia  was  labeled  a  target  in  Islamic  State  videos,  Dabiq  magazine, 
and  public  messages  from  Islamic  State  fighters.34  In  several  cases, 
Australian  Islamic  State  fighters  called  out  to  their  compatriots  to 
launch  violence  at  home  and  sometimes  directly  instigated  attacks. 
Sydney  man  Mohammad  Ali  Baryalei  left  for  Syria  in  2013  and 
joined  Jabhat  al-Nusra,  then  defected  to  the  Islamic  State  and  al¬ 
legedly  instigated  a  terror  plot  resulting  in  the  September  2014 
Operation  Appleby  raids.35  Sydney  woman  Shadi  Jabar  Khalil  Mo¬ 
hammad,  the  sister  of  the  15-year-old  boy  who  murdered  NSW  po¬ 
lice  employee  Curtis  Cheng,  joined  the  Islamic  State  and  married 
Sudanese  national  Abu  Sa’ad  al-Sudani.  After  they  were  killed  in  a 
U.S.  airstrike,  the  Pentagon  described  the  couple  as  “active  in  re¬ 
cruiting  foreign  fighters  and  efforts  to  inspire  attacks  against  west¬ 
ern  interests.”36 

Most  significant  was  Melbourne  man  Neil  Prakash,  a  convert 
from  Buddhism  who  became  Australia’s  most  prominent  Islamic 
State  figure.37  Court  proceedings  for  the  2015  Anzac  Plot  showed 
that  the  Melbourne-based  plotter  believed  Prakash  would  send 
him  the  details  of  Australian  Army  personnel  to  murder.38  This 
resembles  Islamic  State  plots  elsewhere,  such  as  British  jihadi  Ju- 
naid  Hussain’s  attempt  to  direct  an  Ohio-based  terrorist  to  murder 
a  U.S.  military  employee.39  However,  Prakash  does  not  appear  to 
have  sent  the  list,  and  the  plot  ended  up  targeting  police  officers.40 
Prakash  was  reportedly  involved  in  other  violent  efforts  until  he 
was  injured  in  U.S.  airstrike  in  May  2016.  He  was  initially  report¬ 
ed  killed  but  was  later  arrested  in  Turkey  and  might  be  extradited 
to  Australia.41  The  government  described  him  as  “actively  involved 
both  in  recruitment  and  in  encouraging  domestic  terrorist  events 
...  he  was  the  principal  Australian  reaching  back  from  the  Middle 
East  into  Australia,  and  in  particular,  to  terrorist  networks  in  both 
Melbourne  and  Sydney.”42 

All  in  all,  the  Islamic  State’s  emergence,  its  successful  strategy 
for  mass  mobilization,  its  explicit  inclusion  of  Australia  as  a  target 
from  September  2014  onward,  and  its  use  of  Australian  fighters  to 
reach  back  to  their  compatriots  at  home  exacerbated  earlier  trends 
and  escalated  the  jihadi  threat  within  Australia. 

How  the  Threat  Took  its  Current  Form 

While  the  threat  grew  in  scale,  it  also  changed  in  form.  More  plots 
were  occurring,  but  they  were  less  ambitious.  They  tended  to  be 


small-scale  and  only  occasionally  involved  trying  to  make  explo¬ 
sives.  Instead,  they  usually  relied  on  blades  and  non-automatic 
firearms.  One  likely  reason  for  this  is  that  propaganda  explicitly 
encouraged  it.  Since  al-Adnani’s  September  2014  call  to  arms,  Is¬ 
lamic  State  propaganda  has  called  on  its  Western-based  supporters 
to  act  urgently  with  whatever  means  available,  without  having  to 
seek  prior  permission  or  engage  in  long-term  planning.43  Following 
the  Islamic  State’s  exhortations,  these  sorts  of  ad-hoc  plots  have 
increased  throughout  Western  countries.44 

However,  the  current  threat  landscape  has  also  been  shaped  by 
distinct  features  of  Australia’s  counterterrorism  response.  After 
9/11,  the  government  boosted  funding  for  security  agencies,  intro¬ 
duced  new  counterterrorism  laws,  and  created  new  institutional 
arrangements.  Other  measures  included  restricting  access  to  useful 
materials,  such  as  limiting  the  sale  of  fertilizers  that  could  be  used 
to  make  explosives.  Access  to  firearms  was  already  limited  by  gun 
control  measures  introduced  after  a  mass  shooting  in  1996.  (A  black 
market  for  firearms  does  exist  but  is  not  necessarily  easy  for  aspiring 
jihadis  to  access.)  These  measures  made  ambitious  terrorist  plots 
increasingly  difficult;  communication  intercepts  played  during 
terrorism  trials  sometimes  revealed  frustrated  discussions  about 
the  difficulty  of  acquiring  guns.45  Unless  the  terrorists  were  well 
connected  to  broader  criminal  or  terrorist  networks,  they  needed  to 
either  expend  time  and  effort  trying  to  acquire  explosives  or  auto¬ 
matic  firearms  or  act  faster  by  using  alternative  means.  In  line  with 
the  Islamic  State’s  emphasis  on  urgency,  many  plotters  resorted  to 
simpler  methods. 

One  particularly  important  aspect  of  the  security  crackdown  was 
efforts  to  stop  suspected  jihadis  from  traveling.  Being  an  island  with 
few  exit-points,  Australia  was  in  a  better  position  to  restrict  trav¬ 
el  than  many  other  countries.  In  the  first  decade  after  9/11,  ASIO 
canceled  over  50  passports  on  counterterrorism  grounds.46  Agen¬ 
cies  also  curbed  the  activities  of  facilitators  who  arranged  access  to 
jihadi  groups  based  abroad.47  These  actions  helped  prevent  more 
extremists  from  accessing  terrorist  training  and  international  con¬ 
nections. 

Travel  restrictions  carried  their  own  risks,  and  on  some  occa¬ 
sions,  the  suspects  lashed  out  at  authorities.  In  2003,  one  suspect, 
Zaky  Mallah,  threatened  violence  against  government  officials  af¬ 
ter  his  passport  application  was  refused.48  In  2013,  Ahmed  al-Ah- 
madzai,  a  terror  suspect  closely  watched  by  authorities  and  whose 
passport  had  been  denied,  threatened  to  slit  an  ASIO  officer’s 
throat.49  Most  seriously,  this  approach  risked  increasing  the  like¬ 
lihood  of  aspiring  foreign  fighters  turning  to  mass-casualty  terror 
attacks  at  home.  This  became  clear  with  Operation  Neath  in  2009, 
when  the  Victorian  JCTT  foiled  a  plan  by  Melbourne-based  men 
to  carry  out  a  mass  shooting  against  an  Army  barracks  in  Sydney.50 
Some  of  the  plotters  had  earlier  tried  to  join  the  Somali  jihadi  group 
al-Shabaab,  but  they  turned  their  violent  focus  on  Australia  after 
their  passports  were  confiscated.51 

Security  agencies  have  been  aware  of  these  risks  but  judged  them 
to  be  worth  taking,  given  the  benefits.52  Restricting  travel  has  both 
prevented  suspects  from  gaining  deadly  skills  and  connections,  and 
upheld  international  security  obligations  by  stopping  them  from 
posing  a  threat  to  other  countries.5  Consequently,  when  the  Syr- 


g  The  author  agrees  with  this  assessment.  See  Andrew  Zammit,  "In  defence 
of  ASIO's  passport  powers," The  Strategist  blog,  December  4,  2014. 
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ian  civil  war  sparked  a  renewed  foreign  fighter  mobilization,  the 
government  increased  these  efforts.  ASIO  canceled  45  passports 
in  the  financial  year  from  2013-2014,  93  from  2014-2015,  and  62 
from  2015-2016.  This  was  a  significant  escalation,  as  they  had  never 
before  canceled  more  than  20  in  a  single  year.53 

Action  was  also  again  taken  against  facilitators.  In  2013,  the 
New  South  Wales  JCTT  arrested  Hamdi  Alqudsi,  who  was  later 
convicted  for  assisting  at  least  six  Australians  to  join  Ahrar  al-Sham, 
Jabhat  al-Nusra,  and  the  Islamic  State,  and  attempting  to  assist  a 
seventh.54  In  2014,  the  Queensland  JCTT  arrested  Omar  Succarieh, 
later  convicted  for  assisting  a  group  of  Australians  who  had  joined 
Jabhat  al-Nusra.55  In  addition,  the  newly  created  Australian  Border 
Force  was  deployed  to  airports  and  tasked  with  detecting  potential 
jihadis  trying  to  get  on  flights.56 

The  success  in  preventing  travel  likely  played  a  role  in  the  surge 
of  terror  attempts.  Some  of  the  plotters  had  been  prevented  from 
traveling  to  join  the  Islamic  State  shortly  before  their  attacks.  This 
was  the  case  for  Numan  Haider,  who  stabbed  two  JCTT  officers  in 
Melbourne,  and  Sevdet  Besim,  who  conspired  to  murder  one  or 
more  police  officers  during  Anzac  Day  services.57  It  appears  to  have 
also  been  the  case  in  some  of  the  other  incidents,  although  details 
are  unclear  on  those  that  have  not  yet  been  through  court.58 

Police  have  been  a  prominent  target  in  such  plots,  which  is  un¬ 
surprising  given  that  Islamic  State  propaganda  has  singled  out 
members  of  security  agencies  as  ideal  targets.  However,  travel  re¬ 
strictions  and  the  largely  successful  counterterrorism  crackdown 
may  have  contributed  as  well.  The  suspects  were  often  aware  they 
were  under  police  scrutiny,  having  had  their  passports  taken  or 
friends  arrested,  so  there  could  be  elements  of  opportunism  and 
personal  revenge  in  their  decisions  to  target  police. 

However,  if  travel  restrictions  have  partly  prompted  the  surge  in 
attacks,  they  have  also  helped  keep  the  plots  poorly  prepared.  After 
all,  revealing  to  suspects  that  they  are  under  surveillance  potentially 
increases  their  sense  of  urgency.  In  addition,  such  restrictions  can 
leave  plotters  unable  to  establish  substantial  enough  connections 
to  the  Islamic  State  to  gain  terrorist  training  or  logistical  support, 
demonstrated  by  the  absence  of  known  plots  involving  returned 
Islamic  State  fighters. 

Partly  as  a  result,  Australia  has  not  had  to  deal  with  an  Islamic 
State  returnee  problem  on  the  scale  that  Europe  has.  It  is  currently 
estimated  that  around  40  Australians  have  returned  after  fighting 
in  Syria  or  Iraq.59  Most  had  returned  by  early  2013,  before  the  Is¬ 
lamic  State  was  established  in  its  current  form.60  Many  potential 
returnees  may  have  been  deterred  by  the  wave  of  new  counterter¬ 
rorism  laws,  the  public  demonstration  effect  of  counterterrorism 
operations  from  September  2014  onward,  and  the  knowledge  that 
it  is  difficult  to  enter  Australia  unnoticed.  In  contrast,  the  Islam¬ 
ic  State  has  infiltrated  a  significant  number  of  fighters  back  into 
Europe  and  established  substantial  underground  infrastructure.61 
This  has  made  centrally  planned  Islamic  State  plots  less  feasible  in 
Australia  than  in  countries  like  France  and  Belgium. 

That  said,  border  controls  do  not  protect  countries  from  virtu¬ 


ally  planned  attacks,  where  Islamic  State  operatives  in  Syria  and 
Iraq  communicate  with  the  plotters  to  provide  instructions  and  en¬ 
couragement.  In  the  Anzac  Day  2015  plot,  the  Mother’s  Day  2015 
plot,  and  the  February  2015  Sydney  plot,  the  perpetrators  received 
instructions  from  Islamic  State  figures  abroad.62  This  appears  to 
have  also  been  the  case  in  some  of  the  alleged  plots  that  have  not 
yet  been  through  the  courts,  such  as  the  Sydney  2014  plot  allegedly 
ordered  by  Australian  Islamic  State  figure  Mohammed  Ali  Baryalei. 
Nor  do  border  controls  prevent  unconnected  jihadis  from  heeding 
the  Islamic  State’s  call  to  arms.  However,  they  have  helped  keep 
Australia’s  jihadi  threat  manageable  for  the  time  being. 

Conclusion 

The  escalation  of  jihadi  plots  in  Australia  was  in  many  ways  an 
acceleration  of  earlier  trends.  Australia  once  seemed  significantly 
insulated  from  jihadi  threats,  but  after  9/11,  it  faced  a  more  global 
movement,  significant  local  radicalization,  and  increased  strategic 
importance  as  a  target.  This  manifested  in  new  foreign  fighter  flows 
and  terror  plots.  Then  the  Syrian  civil  war  and  rise  of  the  Islamic 
State  escalated  the  threat  further,  as  it  had  in  many  other  countries. 

The  threat  within  Australia  was  shaped  by  global  trends,  but  also 
by  aspects  of  Australia’s  counterterrorism  response.  One  particu¬ 
larly  important  aspect  was  the  use  of  travel  restrictions,  enabled  by 
the  difficulty  of  moving  in  and  out  of  Australia  unnoticed.  These 
travel  restrictions  proved  a  valuable  counterterrorism  tool,  making 
it  difficult  for  Australian  jihadis  to  gain  the  skills  and  connections 
for  the  types  of  centrally  planned  attacks  that  had  caused  mass  ca¬ 
sualties  in  Europe. 

However,  travel  restrictions  do  not  prevent  other  types  of  terror 
plots,  such  as  ones  based  on  remote  instruction  or  individuals  act¬ 
ing  at  their  own  initiative.  By  keeping  frustrated  jihadis  at  home, 
they  potentially  increase  the  risk  of  such  plots.  This  became  more 
apparent  after  September  2014,  when  the  Islamic  State  called  on 
its  supporters  to  launch  immediate  attacks  through  any  available 
method.  Australia  was  one  of  many  countries  in  which  this  call 
found  a  receptive  audience.  Fortunately,  the  same  security  crack¬ 
down  that  kept  many  aspiring  Islamic  State  fighters  at  home  also 
helped  ensure  their  plots  tended  to  be  poorly  prepared  and  closely 
monitored. 

Similar  plots  can  be  anticipated  in  the  future,  but  it  should  also 
be  kept  in  mind  that  the  threat  can  change.  Sophisticated  plots 
involving  Islamic  State  returnees  and  central  planning  are  less 
feasible  in  Australia  than  Europe,  given  the  difficulty  of  returning 
discreetly,  but  cannot  be  ruled  out.  In  addition,  the  failure  of  so 
many  recent  plots  may  lead  attackers  to  turn  to  newer  methods, 
such  as  vehicle  attacks,  as  seen  in  France  and  Germany.  The  threat 
will  also  be  shaped  by  developments  outside  Australia,  particularly 
as  many  Australian  Islamic  State  fighters  remain  active  and  could 
provide  instructions  to  supporters  at  home.  As  the  Islamic  State 
continues  to  lose  territory  in  Iraq  and  Syria,  the  group  is  anticipated 
to  escalate  its  external  violence  in  response,  and  it  has  repeatedly 
shown  its  ability  to  adapt  and  evolve.63 
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Appendix:  Jihadi  Plots  in  Australia  Since  September  2014 

This  table  was  compiled  from  court  documents,  media  reports,  and  other  sources. 

VIOLENT  INCIDENTS 


Date  of  Event 

Event 

September  2014 

Numan  Haider  stabbed  two  Victorian  Joint  Counter-Terrorism  Team  officers,  then  was  shot  dead. 

December  2014 

Harun  Man  Monis  used  a  shotgun  to  take  hostages  in  Lindt  Cafe  in  Sydney.  The  12-hour  siege 
ended  with  the  deaths  of  two  hostages  and  Monis. 

October  2015 

Fifteen-year-old  Farhad  Jabar  used  a  handgun  to  murder  NSW  police  employee  Curtis  Cheng  at 
Parramatta  police  station,  and  then  was  fatally  shot.  Four  alleged  accomplices  have  been  charged, 
some  of  whom  were  linked  to  the  New  South  Wales  JCTT’s  Operation  Appleby  raids. 

September  2016 

A  man  allegedly  stabbed  a  member  of  the  public  in  Sydney  suburb  of  Minto,  allegedly  to  lure  polic¬ 
es  officers  to  be  stabbed,  and  is  currently  facing  trial. 

AT  I  EGED  OR  PROVEN  PLOTS 


Date  of  Main  Arrests 

Event 

September  2014 

Alleged  plot  to  use  firearms  or  knives  against  targets  that  are  currently  unclear,  by  a  man  arrested 
under  the  Queensland  JCTT’s  Operation  Bolton.  One  suspect  was  charged  and  is  facing  trial. 

September  2014 

Alleged  plot  in  Sydney  to  murder  a  random  member  of  the  public  with  a  blade  and  film  it.  The  plot¬ 
ter  was  allegedly  part  of  a  larger  cell  and  received  instructions  from  Syria-based  Australian  Islamic 
State  member  Mohammad  Ali  Baryalei.  The  alleged  plotter  was  arrested  under  the  New  South 

Wales  JCTT’s  Operation  Appleby  and  is  facing  trial. 

December  2014  (until  March 
2016) 

Alleged  plot  to  attack  government  buildings  in  Sydney.  The  suspects  were  arrested  over  many 
months  in  a  series  of  raids  that  were  also  part  of  the  New  South  Wales  JCTT’s  Operation  Appleby. 

Six  alleged  plotters  were  charged  and  are  facing  trial. 

February  2015 

Two  Sydney  men,  Omar  al-Kutobi  and  Mohammad  Kiad,  formed  a  plot  under  instructions  from 
an  Islamic  State  member  in  the  Middle  East  known  only  as  “Rahman.”  The  plan  was  to  firebomb  a 
Shi '  a  institution  and  then  attack  one  or  more  people  with  a  blade.  The  plot  was  foiled  by  the  New 
South  Wales  JCTT’s  Operation  Castrum.  Al-Kutobi  and  Kiad  pleaded  guilty  and  were  sentenced  in 
December  2016. 

April  2015 

Eighteen-year-old  Sevdet  Besim  plotted  to  kill  one  or  more  police  officers  in  Melbourne  during  An- 
zac  Day  (April  25).  He  received  instructions  from  two  Syria-based  Australian  Islamic  State  mem¬ 
bers  and  a  14-year-old  U.K.  child  pretending  to  be  a  significant  Islamic  State  member.  The  plan  was 
to  run  over  a  police  officer  with  a  car,  grab  his/her  gun,  and  start  shooting.  The  plot  was  foiled  by 
the  Victorian  JCTT’s  Operation  Rising.  Besim  pleaded  guilty  and  was  sentenced  in  October  2016. 

May  2015 

An  unnamed  17-year-old  plotted  an  attack  involving  IEDs  to  occur  in  Melbourne  around  Mother’s 
Day.  He  received  some  instructions  from  British  Islamic  State  member  Junaid  Hussain.  Targets  are 
unclear,  but  there  was  discussion  of  a  police  station  or  train  station.  The  plot  was  foiled  by  the  Vic¬ 
torian  JCTT’s  Operation  Amberd.  The  plotter  pleaded  guilty  and  was  sentenced  in  December  2016. 

February  2016 

Alleged  plot  involving  a  Sydney  couple  planning  a  knife  attack.  The  two  suspects  were  arrested 
under  the  NSW  JCTT’s  Operation  Chillon,  and  one  has  been  convicted  and  sentenced  for  refusing 
to  answer  questions.  Otherwise,  both  suspects  are  facing  trial  on  the  terrorism  charges. 

April  2016 

Alleged  plot  in  Sydney  to  carry  out  a  shooting  attack  on  Anzac  Day  (again).  One  suspect  was  arrest¬ 
ed  under  the  New  South  Wales  JCTT’s  Operation  Vianden  and  is  facing  trial. 

May  2016 

Alleged  plot  to  carry  out  a  shooting  attack  against  Parramatta  court  in  Sydney.  One  suspect  was 
charged  under  the  New  South  Wales  JCTT’s  Operation  Sanadres  and  is  facing  trial. 

September  2016 

Alleged  plot  by  a  NSW  prisoner,  for  which  details  are  currently  unclear.  One  suspect  was  charged 
under  the  New  South  Wales  JCTT’s  Operation  Broughton  and  is  facing  trial. 

October  2016 

Alleged  plot  to  carry  out  a  beheading  attack  in  Sydney.  Two  suspects  were  charged  under  a  New 
South  Wales  JCTT  operation  and  are  facing  trial. 

December  2016 

Alleged  plot  to  detonate  IEDs  at  popular  locations  in  Melbourne’s  central  business  district.  Four 
suspects  were  charged  under  the  Victorian  JCTT’s  Operation  Kastelhom  and  are  facing  trial. 
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The  Taliban  Stones  Commission  and  the 
Insurgent  Windfall  from  Illegal  Mining 

By  Matthew  C  DuPee 


The  estimated  value  of  Afghanistan’s  mineral  and 
hydrocarbon  deposits  is  more  than  $1  trillion,  but  political 
instability,  corruption,  and  a  robust  insurgency  have 
resulted  in  the  Afghan  Taliban  and  other  jihadi  groups 
penetrating  nearly  every  aspect  ofthe  Afghanistan’s  lucrative 
extractives  industry.  The  Taliban  exploit  mining  sites  in 
at  least  14  of  Afghanistan’s  34  provinces  and  now  earn  as 
much  as  $200  to  $300  million  annually,  the  second-largest 
revenue  stream  after  narcotics.  The  Taliban’s  increased 
footprint  in  Afghanistan  and  their  efforts  to  formalize 
their  role  in  the  mining  sector  by  creating  the  Dabaro 
Comisyoon,  or  “Stones  Commission,”  have  substantially 
enhanced  their  war  chest.  The  Taliban’s  involvement  in 
Afghanistan’s  mining  sector  will  most  likely  continue  to 
grow  in  scale  and  complexity  for  the  foreseeable  future. 


Afghanistan’s  vast  mineral  deposits,  a  complex  as¬ 
sortment  of  metals,  industrial  minerals,  mineral 
fuels,  precious  and  semi-precious  gems,  and  hy¬ 
drocarbons — including  world-class  deposits  of  iron 
and  copper — is  under  threat  from  a  horde  of  illegal 
mining  syndicates,  including  the  Afghan  Taliban.  The  U.S.  Depart¬ 
ment  of  Defense’s  Task  Force  for  Business  and  Stability  Operations 
(TFBSO)  previously  estimated  that  Afghanistan’s  known  mineral 
deposits  tops  $1  trillion — $908  billion  in  mineral  resources  and 
more  than  $200  billion  in  hydrocarbon  deposits.1  While  illegal  min¬ 
ing  activities  in  Afghanistan  have  long  plagued  efforts  to  create  a 
functioning,  licit  mining  sector,  the  Taliban  have  now  succeeded  in 
penetrating  nearly  every  aspect  of  the  mining  sector.  Increasingly, 
other  jihadi  groups  such  as  the  Islamic  State-Khorasan  Province 
(ISIS-KP)  have  also  entered  the  underground  economy  of  illegal 
mining,  but  so  far,  ISIS-KP’s  activities  are  mostly  restricted  to  the 
limited  areas  under  its  control  in  Afghanistan’s  eastern  Nangarhar 
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Province.2  The  Afghanistan  Anti-Corruption  Network  (AACN)  re¬ 
ported  in  February  2017  that  ISIS-KP  and  the  Taliban  earned  $46 
million  last  year  from  illegally  extracting  talc,  a  soft  mineral  used  in 
the  manufacturing  of  cosmetics,  from  Nangarhar ’s  Khogyani  Dis¬ 
trict.3  Although  it  was  not  determined  how  much  ISIS-KP  earned 
out  of  the  $46  million,  it  demonstrated  that  like  the  Taliban,  ISIS- 
KP  is  diversifying  revenue  streams  and  seeking  to  control  territory 
in  order  to  exploit  its  natural  resources. 

The  Taliban  have  been  careful  not  to  publicize  or  even  confirm 
any  of  their  activities  in  the  mining  sector,  and  they  often  publicly 
deny  any  involvement.4  However,  within  the  Taliban’s  organization¬ 
al  structure,  a  fully  functioning  mining  department  known  as  the 
Dabaro  Comisyoon  (“Stones  Commission”)  manages  the  taxation  of 
extracted  minerals  and  ores  and  even  issues  ‘official’  Taliban  sanc¬ 
tioned  mining  licenses.  The  Dabaro  Comisyoon  operates  under 
the  authority  of  the  Taliban’s  Maali  Comisyoon  (“Financial  Com¬ 
mission”)  and  reportedly  came  into  existence  around  2009  as  the 
Taliban  began  to  experiment  in  diversifying  their  revenue  streams.5 

The  United  States  deployed  an  additional  33,000  troops  to  Af¬ 
ghanistan  beginning  in  2009  as  part  of  a  “surge”  aimed  at  stabiliz¬ 
ing  the  Afghan  government  and  blunting  the  Taliban’s  momentum 
on  the  battlefield.  The  Taliban  prepared  for  the  surge  accordingly 
and  expanded  all  efforts  to  develop  and  maintain  sufficient  finan¬ 
cial  resources.  During  this  time,  Pakistani  authorities  arrested 
Mullah  Abdul  Ghani  “Baradar,”  the  Taliban’s  most  senior  military 
commander  and  deputy  to  then  overall  Taliban  leader,  Mullah 
Mohammad  Omar,  during  an  unprecedented  security  operation 
in  February  2010. 6  The  leadership  vacuum  resulted  in  the  rise  of 
Mullah  Akhtar  Mansour,  a  senior  member  of  the  Taliban  movement 
from  Kandahar  Province  who  maximized  his  tribal  affiliation  as 
a  member  of  the  Ishaqzai  to  profit  from  the  narcotics  trade.7  He 
would  emerge  as  the  de  facto  head  of  the  Taliban  movement  in  July 
2015  following  the  confirmation  that  Mullah  Omar  had  died  of  nat¬ 
ural  causes  years  earlier,  possibly  in  2013,  although  Mansour  had 
largely  led  the  Taliban  movement  since  Abdul  Ghani  Berader’s  ar¬ 
rest.  Mansour,  who  was  killed  in  an  U.S.  airstrike  in  May  2016,  and 
his  close  confidant  and  business  partner,  Mullah  Gul  Agha  Akhund, 
who  also  belongs  to  the  Ishaqzai  tribe  and  served  as  head  of  the 
Taliban  Maali  Comisyoon,  expanded  the  Taliban’s  revenue  streams 
by  exploiting  the  mining  sector  in  Helmand  Province  among  other 
illicit  activities.8 

The  Maali  Comisyoon  oversees  and  manages  the  financial  flow 
of  many  of  the  Taliban’s  illicit  revenue  streams,  including  mining 
activities,  kidnapping  for  ransom,  and  extorting  NGOs.  The  shad¬ 
owy  leader  of  the  Dabaro  Comisyoon  is  reportedly  a  former  Taliban 
media  and  propaganda  figure  from  Ghazni  Province  named  Ahmad 
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Jan  Ahmad.9  a  Given  the  Taliban’s  reluctance  to  publicize  its  illic¬ 
it  financial  activities,  little  more  is  known  about  structure  of  the 
Dabaro  Comisyoon  and  its  purported  leader.*5 

The  Scope  of  Illegal  Mining  Activities 

In  October  2016,  the  U.N.  Analytical  Support  and  Sanctions  Moni¬ 
toring  Team  reported  that  the  Taliban  remained  directly  involved  in 
the  mining  sector  ‘Tty  controlling  illegal  mining  sites,  specifically  in 
the  south  and  east  of  the  country,  by  extorting  sums  from  licensed 
Afghan  mining  operations  and  by  acting  as  a  transport  facilitator 
for  other  illegally  extracted  natural  resources.”10  The  Taliban  are 
now  involved  in  the  illegal  extraction  of  minerals,  ores,  and  precious 
and  semi-precious  stones,  and  they  reportedly  own  several  mining 
and  excavation  businesses  in  southern  Afghanistan. 

The  Taliban  have  been  reaping  significant  sums  from  artisanal 
and  illegal  mining  activities.  Though  a  firm  conclusion  regarding 
an  actual  amount  is  impossible  to  ascertain,  the  Taliban  were  re¬ 
ported,  by  the  Afghan  government  envoy  to  Helmand  in  June  2016, 
to  earn  between  $50,000  and  $60,000  per  day  ($18.5  million  and 
$21.9  million  per  year)  from  mining  and  transporting  marble  in 
the  province.11  In  addition,  they  were  estimated  to  make  as  much 
as  $16  million  from  unlicensed  ruby  extraction  in  Kabul  as  early  as 
201412  and  $6  million  in  2016  from  mining  the  gemstone  lapis  lazuli 
in  Badakhshan  Province.13  While  those  approximations  pertain  to 
only  three  provinces,  one  Afghan  expert  on  the  extractives  industry 
assessed  that  out  of  the  estimated  $2  billion  generated  overall  each 
year  from  Afghan  mining  operations,  the  Taliban  currently  stand  to 
earn  10  to  15  percent,  or  $200  to  $300  million.14  The  same  source 
contended  that  the  Taliban’s  involvement  in  illegal  mining  activities 
had  increased  significantly  since  2012, 15  even  in  areas  that  are  under 
government  control.16 

By  contrast,  the  Afghan  government  reportedly  earned  only  $30 
million  from  mining  revenues  in  2015,  a  paltry  sum  compared  to 
the  current  estimated  revenues  of  the  Taliban  from  mining.17 

The  Taliban,  always  keen  to  adapt  to  military  and  political 
changes  on  the  battlefield,  began  diversifying  revenue  streams  in 
2009  and  2010.  The  trend  became  evident  in  Helmand  Province, 
especially  during  the  lead  up  to  the  extensively  planned  Operation 
Moshtarak  (“Together”),  which  entailed  a  combined  force  of  15,000 
American,  coalition,  and  Afghan  security  personnel  to  retake  the 
town  of  Marjeh,  then  the  key  area  for  Taliban  opium  production. 
Up  until  February  2010,  the  Taliban  had  largely  controlled  the 
small  agricultural  hamlet  of  Marjeh,  and  between  60  and  70  per¬ 
cent  of  local  farmers  relied  upon  the  illegal  opium  trade  as  their 
main  source  of  income.18  Anticipating  significant  financial  loss  from 
losing  control  of  Marjeh  and  its  opium  economy,  the  Taliban  began 
paying  closer  attention  to  Helmand’s  lucrative  natural  resources. 

The  Taliban,  who  had  long  honed  the  processes  of  taxing  local 


a  Ahmad  Jan  Ahmad  shares  a  name  similar  to  a  former  Taliban  Minister  of 
Mines,  Maulavi  Jan  Ahmad,  who  held  the  position  for  a  short  time  during 
the  Taliban  government  era  (1996-2001).  It  should  be  noted  that  these  are 
two  separate  individuals. 

b  The  Taliban  rely  upon  shadow  administrations,  commissions,  and 

commanders  active  in  rural  communities  to  manage  and  tax  local  mining 
operations  and  charge  taxes  for  each  ton  of  stone  transported  from  the 
mining  site.  The  finances  are  most  likely  managed  by  provincial-level 
Taliban  officials,  who  relay  portions  of  the  coffer  to  the  Dabaro  and  Maali 
Comisyoons. 


farmers’  10  percent  of  their  harvest  and  2.5  percent  on  their  wealth, 
probably  applied  similar  measures  against  local  mining  firms  op¬ 
erating  in  vulnerable  and  rural  districts.  The  Taliban’s  budding  en¬ 
trance  into  the  mining  sector  is  not  well  documented.  The  U.N. 
reported  in  201219  that  the  Taliban  had  earned  a  combined  total  of 
$400  million  from  a  wide  array  of  illicit  enterprises,  such  as  taxing 
local  economies  including  the  narcotics  trade,  extorting  business¬ 
es  and  NGOs,  and  fundraising,  but  illegal  mining  activities  went 
unreported  until  2013.  The  U.N.  cautiously  observed  in  2013  that 
the  Taliban  had  begun  to  “specifically”  target  gemstone  mining 
operations,  noting  that  the  World  Bank  estimated  that  90  to  99 
percent  of  Afghanistan’s  gemstones  were  illegally  smuggled  out  of 
the  country.20 

A  second  catalyst  for  the  Taliban’s  deepening  involvement  in 
illegal  mining  activities  occurred  after  the  United  States  formally 
ended  its  combat  mission  in  Afghanistan  at  the  end  of  2014.  The 
NATO  mission  in  Afghanistan  was  renamed  Resolute  Support  and 
focused  on  training,  advising,  and  assisting  the  Afghan  National 
Security  Defense  Forces  (ANDSF),  which,  at  that  point,  assumed 
responsibility  for  all  security  operations.  Since  the  transition,  the 
Taliban  have  continued  to  make  territorial  gains  throughout  the 
country.  Only  about  57  percent  of  the  Afghanistan’s  407  districts 
were  considered  under  Afghan  government  control  or  influence 
as  of  November  15,  2016,  a  six  percent  decrease  from  the  63.4 
percent  reported  last  quarter  in  late  August  2016  and  a  nearly  15 
percent  decrease  since  November  2015.21  The  Taliban  controlled 
11  of  Helmand’s  14  districts  by  August  2016, 22  hence  creating  a  de 
facto  shadow  state  and  allowing  the  Taliban  to  further  exploit  the 
mining  sector,  the  drug  trade,  and  other  illicit  commodities.  Local 
media  and  civil  society  reporting  throughout  2016  identified  at  least 
1,400  illegal  mining  sites  located  in  at  least  14  of  Afghanistan’s  34 
provinces' — 710  of  which  are  in  the  Kabul  area  alone23— that  are 
exploited  by  the  Taliban  and  other  insurgents.  Overall,  there  are 
some  10,000  mineral  deposits  reportedly  located  in  areas  outside 
of  the  government’s  control.24  In  June  2016,  a  spokesman  for  the 
Afghan  Ministry  of  Interior  acknowledged  the  challenges  associat¬ 
ed  with  illegal  mining  activities  and  claimed  that  the  Afghan  gov¬ 
ernment  had  stopped  1,270  illegal  mining  operations.25  However, 
it  was  unclear  when  and  where  those  illegal  mining  operations  had 
been  disrupted. 

Dabaro  Comisyoon  at  Work  in  Helmand  Province 

In  the  volatile  southern  province  of  Helmand,  which  has  nearly 
collapsed  to  the  Taliban  every  year  since  2014,  the  illegal  cultiva¬ 
tion,  processing,  and  trafficking  of  narcotics  has  remained  a  critical 
financial  resource  for  the  Taliban.  The  Taliban  dominate  many  as¬ 
pects  of  Helmand’s  thriving,  multi-billion  narcotics  industry,  which 
revolves  around  the  illicit  cultivation  of  poppy,  which,  in  turn,  is 
used  to  produce  opium  and  refined  heroin  as  well  as  the  cultivation 
of  cannabis.  This  is  used  to  create  hashish,  a  potent  marijuana  resin. 
The  U.N.  estimates  that  the  Taliban  earned  $400  million  from  the 
narcotics  industry  in  2016.26  In  addition  to  narcotics,  Helmand’s 
mineral  resources  are  now  extensively  exploited  by  the  Taliban  in 
areas  inside  and  outside  of  government  control. 


c  The  provinces  include  Badakhshan,  Bamyan,  Ghazni,  Helmand,  Kabul, 
Khost,  Kunar,  Logar,  Nangarhar,  Paktia,  Paktika,  Panjshir,  Parwan,  and 
Wardak. 
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Slabs  of  rokhaam  ( marble )  await  further  processing  at  a  warehouse  in  Lashkar  Gah  City,  Helmand  Province,  on  March  6,  2017-  These 
stones  are  representative  of  the  only  two  percent  of Helmand 's  overall  marble  output  that  can  be  taxed  by  the  Afghan  government  and 
sold  to  local  Afghan  markets.  The  rest  is  exploited  by  the  Taliban  and  smuggled  to  Pakistan.  Photograph  provided  to  the  author  by  a 
source  in  Helmand  Province. 


While  the  Afghan  government’s  envoy  to  Helmand  reported  in 
June  2016  that  the  Taliban  earn  between  $18.25  million  and  $21.9 
million  per  year  from  mining  and  transporting  marble,27  sources 
in  Helmand  reported  in  January  2017  that  the  Taliban  most  likely 
earn  much  more  than  the  government  is  reporting.  The  Talibans 
taxation  of  marble  differs  depending  on  the  color  and  quality  of 
the  stone.  The  four  most  common  types  of  marble,  known  locally 
as  rokhaam,  are  yellow,  light  green,  dark  green,  and  pink.  Veins  of 
yellow  marble  are  now  uncommon;  light  green  is  considered  the 
lowest  quality;  dark  green  is  the  second  best;  and  pink  is  considered 
the  best  quality  stone. 

The  Taliban  charge  a  tax  for  each  truck  used  to  transport  the 
mined  stones,  and  depending  on  the  type  of  marble  being  trans¬ 
ported,  the  tax  ranges  from  25,000  Pakistani  rupees  ($238.54)  to 
60,000  Pakistani  rupees  ($572.49)  per  ton.  Trucks  can  carry  be¬ 
tween  7  and  40  tons  each,  depending  on  the  type  of  vehicle.4  The 
U.N.  Analytical  Support  and  Sanctions  Monitoring  Team  reported 
in  2015  that  between  2008  and  2014,  mining  operations  extracted 
124,000  to  155,000  tons  of  marble  from  Helmand  each  year.28 

Sources  in  Helmand  also  estimated  that  around  50  trucks  are 
used  to  smuggle  hundreds  of  tons  of  marble  from  Helmand  into 
Pakistan  every  day,  while  only  two  percent  of  Helmand’s  extracted 
marble  end  up  in  Lashkar  Gah,  the  provincial  capital,  where  the 


d  As  of  January  2017,  the  Taliban  charged  the  following  taxes  for  marble 
extracted  in  Helmand— Light  Green:  25,000  Pakistani  rupees  (PRs) 
($238.54)  per  ton;  Dark  Green:  30,000  to  40,000  PRs  ($286.25  -  $381.66) 
per  ton;  and  Pink:  50,000  to  60,000  PRs  per  ton  ($477.08  -  $572.49). 


marble  is  further  processed  and  sold.29  Of  the  meager  two  percent 
of  marble  that  remains  in  Afghanistan,  the  government  is  only  able 
to  tax  3,500  afghanis  ($33.40)  per  ton.30 

In  addition  to  taxing  the  transport  of  minerals,  the  Taliban  in 
Helmand  now  also  charge  mining  operators  for  a  license  to  exca¬ 
vate.  From  the  Talibans  perspective,  this  was  a  key  achievement  of 
the  Dabaro  Comisyoon,  helping  it  to  dramatically  increase  reve¬ 
nues.  Some  mining  operators  also  pay  the  government  for  a  license, 
but  many  only  carry  the  license  issued  by  the  Taliban.  The  U.N. 
estimates  that  there  are  at  least  35  illegal  marble  mining  sites  in 
Helmand,  many  of  which  are  located  in  desolate,  Taliban-controlled 
areas  of  Dishu  District.31 

Taliban  officials  from  the  Dabaro  Comisyoon  and  Maali  Comi¬ 
syoon— who  maintain  a  presence  in  Khan  Neshin  District  as  well 
as  in  nearby  Baram  Chah,  a  well-known  haven  for  insurgents— 
smugglers,  and  traffickers  collect  the  payments  and  taxes  from  the 
mining  operations.32  It  is  even  alleged  that  some  of  the  excavation 
companies  are  owned  by  senior  Taliban  commanders,  including 
various  family  members  of  Amir  Khan  Motaqi,  a  senior  Taliban 
commander  in  charge  of  the  ‘Cultural’  Commission.33  The  Taliban 
shadow  governor  for  Helmand,  Mullah  Manan,  a  member  of  the 
Ishaqzai  tribe,  and  Dabaro  Comisyoon  official  Mullah  Mohammad 
Essa,  a  Noorzai  Pashtun  originally  from  Spin  Boldak,  Kandahar 
Province,  reportedly  run  the  Taliban’s  illegal  mining  operations  in 
Helmand.34 

The  contemporary  manifestation  of  the  Dabaro  Comisyoon  is 
a  far  cry  from  the  Taliban’s  past  attempts  at  exploiting  local  min¬ 
ing  operations,  many  of  which  were  ad  hoc  or  temporary  efforts 
to  tax  the  smuggling  of  precious  stones  and  eventually  industrial 
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ores  such  as  chromite.  The  Dabaro  Comisyoon,  which  functions 
under  the  authority  of  the  powerful  Maali  Comisyoon  (the  Talihan 
Financial  Commission),  is  tasked  with  streamlining  the  Taliban’s 
financial  intake  from  mining  operations  through  taxation  and  the 
issuance  of  excavation  licenses  and  through  trafficking  operations. 
The  Dabaro  Comisyoon  is  reportedly  also  tasked  with  managing  the 
revenues  earned  from  taxing  mining  companies  and  those  tasked 
with  transporting  the  stones  throughout  the  country  (and  not  only 
in  Helmand  Province).  It  also  maintains  relations  with  Pakistani 
businessmen  who  help  facilitate  the  black-market  sale  of  Afghani¬ 
stan’s  illegally  excavated  natural  resources.35 

Illegal  Mining  Close  to  Kabul 

Illegal  and  unregulated  mining  activities  are  not  only  pertinent  to 
isolated  rural  communities  long  outside  the  government’s  control. 
The  village  of  Nili,  located  in  Parwan  Province— approximately  25 
miles  from  Kabul  City  and  12  miles  from  the  sprawling  U.S.  base 
at  Bagram  Airfield— is  reportedly  a  hub  for  the  illegal  mining  of 
nephrite  jade,  a  decorative  stone  used  in  ornaments  and  jewelry. 
Taliban  insurgents  reportedly  have  controlled  mining  operations  in 
Nili  for  most  of 2016.36  The  jade  is  trafficked  through  the  mountains 
by  mules  until  it  reaches  Sarobi  District,  Kabul  Province,  where  it  is 
then  transferred  to  trucks  and  transported  farther  east  to  markets 
in  Pakistan. 

Sarobi  itself  is  also  illegally  exploited  for  its  precious  stones, 
mostly  rubies.  Taliban  insurgents  have  controlled  a  mountainous 
area  near  the  village  of  Jegdalek6  in  Sarobi  District  since  at  least 
2012,  when  reports  first  emerged  indicating  that  the  Taliban  had 
coerced  locals  to  illegally  mine  the  mountains  for  rubies.  One  such 
high-quality  ruby  extracted  there  allegedly  sold  for  $600,000  to  a 
buyer  in  Dubai,  UAE.37  Despite  an  Afghan  security  operation  code- 
named  “Iron  Triangle”  that  successfully  routed  insurgents  from  sev¬ 
eral  enclaves  of  Sarobi  in  2015,  the  illegal  extraction  and  smuggling 
of  rubies  from  Sarobi  continued  unabated  in  the  summer  of  2016.38 
Most  of  the  precious  stones  illegally  extracted  from  mines  in  Kabul 
are  smuggled  to  Peshawar,  Pakistan;  the  rubies  are  typically  sorted 
for  quality  and  sold  in  the  gem  stalls  of  Peshawar’s  Namak  Mandi 
market.39 

Areas  located  immediately  west  and  southwest  of  Kabul  City 
paint  a  similar  picture.  In  2015,  officials  in  Wardak  Province  re¬ 
ported  that  the  Taliban  effectively  tax  a  lucrative  mining  site  where 
limestone,  an  industrial  mineral,  is  extracted.40  Similarly,  the  mas¬ 
sive  coal  deposits  in  Bamyan  Province,  part  of  the  rugged  central 
highlands  and  ancestral  home  of  ethnic  Hazaras — an  historic  ene¬ 


e  The  Jegdalek  area  of  Sarobi  is  world-renowned  for  its  gem  stones  and 

marble  deposits.  In  fact,  a  portion  of  the  Taj  Mahal— the  world  famous  ivory- 
white  marble  mausoleum  in  India— was  built  using  marble  extracted  from 
Jegdalek. 


my  of  the  Taliban— have  also  been  exploited  by  the  Taliban  despite 
a  large  portion  of  the  coal  mines  being  closed  in  2013.  The  Taliban 
have  allegedly  taxed  every  truck  of  coal  extracted  from  the  Kahmard 
coal  site,  earning  approximately  $3,000  per  day  (approximately 
$1.1  million  per  year)  in  2015.41 

Conclusion 

Although  the  Taliban  enjoy  a  diverse  array  of  income  generation, 
reaping  hundreds  of  millions  of  dollars  from  the  illicit  drug  trade, 
kidnapping  for  ransom,  and  extortion  rackets,  they  have  formalized 
its  exploitation  of  Afghanistan’s  natural  resources  by  creating  the 
Dabaro  Comisyoon.  Since  its  inception,  and  under  the  leadership 
of  Akhtar  Mansour  and  his  confidant  Gul  Agha  Akhund  from  2010 
to  2016,  the  Dabaro  Comisyoon  has  emerged  as  one  of  the  most  ef¬ 
fective,  efficient,  and  enduring  business  enterprises  associated  with 
the  Afghan  Taliban. 

The  Taliban’s  momentum  in  penetrating  the  mining  sector  has 
continued  uninterrupted  over  the  past  several  years  and  will  most 
likely  continue  to  grow  in  scale  and  complexity  in  the  near  term, 
especially  in  areas  under  total  Taliban  control.  The  Taliban  are  ac¬ 
tively  engaging  in  illegally  mining  activities  in  at  least  14  of  Afghan¬ 
istan’s  34  provinces,  including  Kabul.  Estimates  that  the  Taliban 
now  earn  upward  of  $200  to  $300  million  annually  from  the  ille¬ 
gal  excavation  of  various  metals,  industrial  minerals,  mineral  fuels, 
and  precious  and  semi-precious  gem  stones  are  certainly  plausible; 
however,  firm  conclusions  remain  difficult  to  prove. 

The  licit  prospects  of  Afghanistan’s  vast  natural  resources  are 
fleeting,  a  sentiment  that  is  slowly  seeping  from  civil  society  or¬ 
ganizations,  extractives  experts,  and  Afghan  government  officials 
alike.  A  former  senior  Afghan  official  with  detailed  knowledge  of 
the  extractives  industry  recently  told  the  author,  “Afghanistan  is  a 
very  mineral-rich  country,  but  mining  by  itself  can  never  result  in 
sustainable  development  unless  there  are  strong  political,  legal,  and 
financial  frameworks  in  place  to  manage  this  potential — something 
that  needs  patience  and  perseverance  in  pursuing  the  right  policy. 
Unfortunately,  neither  Afghan  politicians  nor  the  international  do¬ 
nor  community  seems  to  have  this  patience.  The  mining  sector  [in 
Afghanistan],  at  this  point,  is  bleak.”42 

Despite  international  involvement  to  stabilize  Afghanistan  over 
the  past  15  years,  the  Afghan  government  remains  vulnerable  and 
continues  to  suffer  from  inadequate  security  a  lack  of  modern  in¬ 
frastructure,  corruption,  and  belligerent  neighbors  that  undermine 
Afghanistan’s  economic  potential  and  directly  threatens  its  physical 
security.  Afghanistan’s  projected  mineral  wealth  is  unlikely  to  be 
realized  over  the  next  generation,  although  small-scale  artisanal 
and  illegal  mining  activities  will  most  likely  continue  to  expand  in 
size  and  scope.  The  Taliban  will  inevitably  remain  at  the  forefront  of 
Afghanistan’s  many  illegal  mining  activities,  especially  in  Helmand 
Province,  which  has  galvanized  into  the  center  of  gravity  for  the 
Taliban’s  illicit  revenue  streams.  CTC 
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